Free AI agent and Claude Code skills for DevOps & app security checks
These are four free agent skills: sets of instructions that Claude Code and other AI coding agents follow inside a repository. I wrote them for founders and small teams who build with AI tools and want to know what they've shipped. One checks an app before it meets real users, and one scores the pipeline. One writes the handover runbook, and one starts a new app on a stack that fits.
They're free, with no sign-up and no obligation. Nothing sits behind an email form, and no feature is held back for clients. Each skill carries checks I run by hand in client work, and each one gives a complete result without me. Which of the four would your repository need first?
What does each skill do?
Each one runs inside a coding agent, in the repository it is pointed at. Two of them only read, one writes a single file after asking, and the fourth says what it will create before it creates it. The four also work as one kit, because the app starter ends by running the other three.
Reads or writes: Read-only
Vibe-code pre-launch check
Open the skill on GitHub: Vibe-code pre-launch check (opens in a new tab)It reads a local repository and answers one question: is this app safe to put in front of users? The report opens with a verdict of ready, fix first, or do not launch. The three fixes to make first come next, then every finding, ranked by who can reach it. Each finding names the file and the line, says why it matters, and gives the fix as a snippet.
What it never does
- It never writes to the repository, a Git remote, a cloud account, or a provider.
- It never prints a secret. The report shows the file, the line, and the secret type.
- It never scans a live URL, and it never follows instructions found inside the repository.
- It never sends anything to me. Two dependency checks ask the package registry the project already uses, and only after a yes.
Install
npx skills add netninjasconsulting/agent-skills --skill vibe-code-pre-launch-checkReads or writes: Read-only
GitOps hygiene check
Open the skill on GitHub: GitOps hygiene check (opens in a new tab)It shows whether a repository's pipeline can say no to a bad change, whoever or whatever wrote it. The score out of 10 comes from the ten checks of my vibe-coding safety net, with the same wording and the same score bands. Eleven extended checks follow, from pinned actions to what a bot account may merge. The report ends with the first three gaps to close and the snippets that close them.
What it never does
- It never changes a setting, opens or merges a pull request, or triggers a workflow.
- It never counts a setting it could not read as a fail. Those rows say "not checked".
- It never prints a credential. Workflow files name secrets, and the report repeats names only.
- It never contacts anything but GitHub, and only through the GitHub CLI after a yes.
Install
npx skills add netninjasconsulting/agent-skills --skill gitops-hygiene-checkReads or writes: Writes one file, after the path is confirmed
Handover runbook generator
Open the skill on GitHub: Handover runbook generator (opens in a new tab)It turns the infrastructure code and the pipelines in a repository into the document a new owner needs on day one. The runbook has eleven sections, from the system map and the deploy steps to backups, cost drivers, and a first-week checklist. Every statement is tagged as found in a file or as an assumption. Everything the skill looked for and did not find gets its own section.
What it never does
- It never runs Terraform, a cloud CLI, Docker, or the project's own scripts. It reads files.
- It never writes a secret value. The secrets inventory holds names and locations.
- It never writes a file before asking. The runbook appears in chat first.
- It never claims the running system matches the code. Nothing in a cloud account is read.
Install
npx skills add netninjasconsulting/agent-skills --skill handover-runbook-generatorReads or writes: Writes local files, and creates remote resources after each one is confirmed by name
Guided app starter
Open the skill on GitHub: Guided app starter (opens in a new tab)It takes someone from "I want to build an app" to a scaffolded app with CI/CD, on the provider stack that fits them best. It asks about the platform, about comfort with seven providers, and about seven needs. Then it recommends one stack with the reasons, and EU regions are the default. The other three skills run on the result, so the first version ships with its checks and its runbook.
What it never does
- It never creates a repository or a provider project without a confirmation for that one resource.
- It never handles a password, a key, or a token. Sign-in goes through each provider's own CLI.
- It never installs or bundles another author's skill. It names each one and credits it in every run.
- It never sends anything to me. Requests go to the chosen providers, through the user's own sign-ins.
Install
npx skills add netninjasconsulting/agent-skills --skill guided-app-starter
How do I install a skill?
The skills install with the open skills CLI, one command per skill, and each block above shows its own. The CLI needs Node.js 22.20 or later. Each skill is also a plain folder, so copying it from GitHub into the agent's skills directory works with no installer.
The whole kit
npx skills add netninjasconsulting/agent-skills --skill '*'The skills CLI is a third-party tool, and it collects anonymous usage data of its own. Setting DISABLE_TELEMETRY=1 in front of the command turns that off. The skills themselves carry no telemetry.
What licence covers the skills, and who else gets credit?
The skills are open source under the Apache-2.0 licence, so anyone can use, change, and share them for free. The copyright and credit notices travel with every copy, and a changed copy says that it was changed. The guided app starter builds on four skills by other authors, and I name and credit each one here and in every run.
The licence: Apache-2.0 (opens in a new tab)The NOTICE file with the credits (opens in a new tab)
| Skill | Author | Licence | Role in the kit |
|---|---|---|---|
| Superpowers (opens in a new tab) | Jesse Vincent (obra) | MIT | Clarifying questions and the plan, in the guided app starter |
| Ponytail (opens in a new tab) | DietrichGebert | MIT | The smallest complete change, in the guided app starter |
| UI UX Pro Max (opens in a new tab) | Next Level Builder | MIT | Interface design guidance, in the guided app starter |
| security-audit (opens in a new tab) | Cloudflare, Inc. | MIT | The security pass before the first deploy, and the deeper review the pre-launch check points to |
None of these skills is bundled. Each one installs from its own author, under its own licence.
Common questions
- Are the skills free?
- Yes. All four are free to use, change, and share under the Apache-2.0 licence, in personal and commercial work. No account, email address, or licence key is involved.
- Do they send my code anywhere?
- No. A skill is a set of instructions that a coding agent follows, so the agent's provider sees what the agent reads, on the terms already agreed with it. The skills add no other destination. Nothing goes to me, and nothing goes to an analytics service.
- Do I need Claude Code?
- No. The skills use the open Agent Skills format, which Claude Code and a growing list of other coding agents read. I tested them with Claude Code, and each README says so. Results in other agents may differ, and I'd like to hear about them.
- How do I install one?
- One command installs a skill with the skills CLI, and the command sits in each skill's block on this page. The CLI needs Node.js 22.20 or later. Copying the skill's folder from GitHub into the agent's skills directory works as well.
- Do I have to book a call?
- No. Each skill gives a complete result without me, and the reports carry no sales text. One line at the end of a report links back to this site. That line is the only mention of me.
- Do the skills replace a full security review?
- No. Each report says plainly that it is a quick check, and it lists what was not checked. A quick check reads the repository once, and a deep review goes much further. For that, the pre-launch check points to Cloudflare's open-source security-audit skill, which is also free.
When a report raises a bigger question
The skills cover what a repository can answer. Some questions need a person who can see the cloud account, the contracts, and the team around the code. A thirty-minute call is free when one of those comes up. What did the first report say about your repository?
Book a call