/find-misconfig

Scans the current project for common misconfigurations in infrastructure, CI/CD, and application settings, reporting issues with severity and remediation guidance.

Audits configuration management, environment variables, secrets handling, and settings organization, then produces a prioritized improvement plan saved as a markdown report.

Performs an on-demand security audit of uncommitted changes, directories, or full codebase — scans for OWASP vulnerabilities, secrets, dependency issues, and IaC misconfigurations.

Reviews current infrastructure code against cloud foundation principles, identifies violations with file/line references, suggests fixes, and provides severity-based summary.

Runs an agentic security scanner on the project, detecting vulnerabilities across SCA, secrets, authz, MCP, pipeline, and logic surfaces. Supports focused scans per surface and supplementary output blocks.

Audits a project's GitHub Actions workflows against its declared tech stack, filing issues for missing config validation checks.