Help us improve
Share bugs, ideas, or general feedback.
From vanguard-frontier-agentic
Reviews Helm chart source for quality, security, and testability defects — container security contexts, resource governance, health probes, RBAC permissions, secrets handling, and test coverage.
npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticHow this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:helm-chart-quality-reviewThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill reviews Helm chart source for quality, security, and testability defects. It reads chart files statically — Chart.yaml, values.yaml, values.schema.json, templates/, tests/, and CI configuration — without installing the chart or contacting a Kubernetes cluster. The review surfaces defects that allow bad workloads to be deployed silently: insecure container security contexts, missing r...
Validates and audits Helm charts with linting, template rendering, YAML/schema checks, CRD verification, dry-runs, and security best practices.
Secures Helm chart development with dependency auditing, provenance verification, secret handling, and configuration scanning via checkov.
Provides quick reference for Helm chart structure, Chart.yaml config, Go templating, values patterns, commands, dependencies, testing, and security best practices. Activates on Chart.yaml, values.yaml, templates/.
Share bugs, ideas, or general feedback.
This skill reviews Helm chart source for quality, security, and testability defects. It reads chart files statically — Chart.yaml, values.yaml, values.schema.json, templates/, tests/, and CI configuration — without installing the chart or contacting a Kubernetes cluster. The review surfaces defects that allow bad workloads to be deployed silently: insecure container security contexts, missing resource governance, absent health probes, RBAC over-permission, hardcoded or default credentials, and missing helm test coverage.
privileged: true, capabilities.add: [ALL] or any combination that grants root-equivalent privileges as CRITICAL — stop and flag before continuing.hostNetwork: true, hostPID: true, or hostIPC: true as CRITICAL — these give a container visibility into the node's network stack, process table, or IPC namespace.ClusterRoleBinding to the default service account as CRITICAL — any workload in the namespace inherits cluster-scoped access.capabilities.add: [SYS_ADMIN] or [NET_ADMIN] as CRITICAL — these grant near-root kernel capabilities.:latest image tags without override capability as HIGH — breaks reproducibility and makes rollback unreliable.securityContext.runAsRoot: true or the absence of runAsNonRoot on pod or container spec as HIGH — workloads should not run as UID 0.allowPrivilegeEscalation not explicitly set to false as HIGH — a child process can gain more privileges than the parent.serviceAccount.automountServiceAccountToken not set to false when the workload does not call the Kubernetes API as HIGH — the token is mounted unnecessarily and exploitable.resources.requests and resources.limits on every container as HIGH — without limits, a misbehaving pod can trigger node over-subscription and OOM kills on neighbours.livenessProbe or readinessProbe as HIGH — rolling updates proceed blind; a pod stuck in a failed state can be sent live traffic.admin, password, empty string) in values.yaml as CRITICAL — users forget to override defaults and ship them to production.values.schema.json when required values carry no type or pattern constraint as MEDIUM — helm install accepts arbitrary input with no validation.readOnlyRootFilesystem: true as MEDIUM — a container with a writable root filesystem can modify its own binaries or drop exploit payloads.startupProbe for slow-starting containers as MEDIUM — liveness checks kill containers that need more startup time, causing crash loops.PodDisruptionBudget for stateful or singleton workloads as MEDIUM — node drains can take the workload to zero replicas.HorizontalPodAutoscaler where the workload is expected to scale as LOW.NOTES.txt as LOW — users have no post-install guidance.tests/ that contain only pod-existence checks and no service reachability or functional assertion as LOW — existence proves the pod started, not that the service works.tests/ directory at all as MEDIUM — helm test integration is absent.ct lint-and-install or equivalent) as MEDIUM — the chart is not regression-tested on install.chart source provided, values only, documentation-based, or inference.helm upgrade or kubectl apply.Load these only when needed:
Return, at minimum:
:latest tags)