should-i-care

Run a compliance-focused check of a Claude Code setup across network egress, Anthropic routing, long-running automation, sensitive-data exposure, and audit controls. The skill separates locally verified evidence from account, region, payment, and identity facts that only the user can confirm, then returns a risk level and practical remediation steps. It is not a ban-evasion tool and does not advise proxy rotation, fake identities, or unsupported-region bypasses.

Use this skill to create or update credentials in 1Password, generate commit-safe .env.tpl files containing op:// references, and inject resolved values only when a command runs. It also documents rotation and integrations for common development tools. The 1Password CLI v2 must be installed and signed in, and the recommended op run pattern avoids unsafe source or eval-based injection.

production-audit examines a project’s live URL, public GitHub signals, and repository structure to surface high-impact launch risks such as webhook idempotency, RLS gaps, exposed secrets, missing rate limits, and database indexing issues. It complements in-editor security review by checking the state users actually receive after deployment. The service is primarily intended for public repositories with a live app and calls the commit.show audit API.

Scan Solana code for return-data spoofing, arbitrary program invocation, stale account state after CPI, and unsafe PDA signing. The skill routes findings to Anchor or native Pinocchio guidance, explains the exploit path, and proposes concrete remediations through an audit command and dedicated agent. Runnable LiteSVM proof-of-concept suites demonstrate vulnerable, defended, and positive-control cases, with especially detailed coverage of spoofed CPI return data.