Prod Check — Security skill for Claude Code

prod-check

Find the bugs that end startups before your first customer finds them: leaked keys, other users' data, fake payments, no restorable backup.

Run `/prod-check` in your repo. In about 30 minutes your agent checks up to 68 high-risk items with evidence (file:line, command output); anything it cannot reach is reported UNKNOWN. It then hands you the top 5 fixes.

Read-only in production; replays write only to a test environment you provide; test alerts and messages are sent only with your OK. Built for agent-written apps: catches pasted keys, packages that don't exist, IDOR in server actions, Supabase tables open to the browser, and webhooks nobody verifies.

Going enterprise later? `full` covers all checks up to SSO, SOC 2 and DPAs. You don't need those yet.

Based on a checklist by Mari Luukkainen.

Install

Claude Code:

git clone https://github.com/lisbeth718/prod-check ~/.claude/skills/prod-check

Then run `/prod-check` in your app's repo.

Other agents: give the agent the path to `SKILL.md` and tell it to follow it. It reads the files under `references/` as needed.

Humans: work through `CHECKLIST.md`. Each line has an ID, a tier and a gate. `references/checks/` says how to verify each one.

Usage

/prod-check                      quick audit (default), 68 checks
/prod-check full                 every check in scope, 187 checks
/prod-check quick auth billing   only those sections
/prod-check full 05-database-data-model

Quick mode runs and reports only a short list of the highest-risk checks. See `references/quick-profile.md`. Fixes are proposed after the report and applied only when you say go.

How it works

Tiers and gates

A weekend landing page and a multi-tenant billing app do not need the same checks. Each check has a tier, and some sections are gated on a feature.

• T0 Public site: no accounts, no payments, no customer data.
• T1 Paying: any of: accounts, customer data, payments.
• T2 Enterprise/regulated: SSO,