Audit deployed repos for production-readiness gaps

production-audit is a Claude Code skill that audits a shipped repo for the production-readiness gaps roughly 70% of AI-coded projects miss. Unlike in-session skills that scan the editor buffer at write-time, it scans the shipped product itself - deployed URL, GitHub signals, and repo structure - using the same audit engine that powers commit.show: scoring, ranking, and a 14-frame failure framework calibrated against a reference set of real OSS projects.

The 14 checked failure modes are: webhook idempotency (Stripe/payment retry safety), RLS gaps per table on Postgres, service-role secret exposure in shipped bundles, database indexes missing against FK columns, observability tooling presence (Sentry/Datadog/Pino/OTel), API rate limiting, prompt-injection surface from raw user input, hardcoded localhost URLs leaked to prod, inline mock data in app paths, webhook signature verification, permissive CORS on auth endpoints, iOS Safari mobile-input focus-zoom, column-level GRANT mismatches on new migration columns (a silent 42501 across all reads), and outbound Stripe API calls missing an idempotency key. A Claude Sonnet qualitative pass on top reads the README, build brief, Lighthouse results, and GitHub commit cadence to write the bullets the user actually sees.

Use it after merging a feature, before a demo, or before posting to Show HN - trigger phrases include "is this production-ready", "what would break in prod", "score my project", and "audit my repo". It runs alongside, not instead of, in-session skills: security-review, vibesec, and OWASP-style skills catch insecure patterns as you type but can't see whether a live URL returns 200, whether og:image and manifest.json are wired, whether Lighthouse collapses on mobile, or whether yesterday's migration silently broke every PostgREST query touching that column; tdd-workflow and test-coverage cover the test-discipline lens the audit's own tests slot only loosely signals. Run both lenses for a serious launch. It's calibrated for deployed apps with a live URL - a library, CLI, or scaffold gets a partial-substitute score (capped around 45/50 on the audit pillar); private, non-GitHub repos return not_found, since it only reads public GitHub signals.

After install, describe the problem in plain language ("is this production-ready?", "score my project"); Claude Code triggers the skill, which runs npx commitshow audit . --json, parses the envelope, and surfaces the top concerns with file paths - a numeric score out of 100 with its delta since the last run and a band (e.g. "strong"), followed by the top few concerns tagged by category (such as Security or Infrastructure) with the specific file and gap named. The skill writes .commitshow/audit.{md,json} to the repo so future sessions can read prior state without re-running the engine. A cold audit takes 60-90 seconds; cached audits under 7 days return instantly, and --refresh force-bypasses the cache. Behind a firewall blocking *.supabase.co, use npx commitshow audit . --json --no-network for the deterministic-only fallback.

Calls the commit.show API at https://api.commit.show. Install via npx skills add commitshow/production-audit (tags the run with --source=production-audit-skill for funnel analytics, droppable for full anonymity), the Claude Code plugin marketplace (/plugin marketplace add https://github.com/commitshow/production-audit), or a manual git clone into ~/.claude/skills/production-audit. Anonymous rate limits are 20 audits per IP per day, 5 per repo per day, 2000 globally per day; login plus paid credit raises the per-repo cap.

Developers and teams who want an outside-in check on what will actually break in production - secrets exposure, missing rate limiting, unverified webhook idempotency, or prompt-injection surface - right after merging to main or before a public launch, run alongside editor-time linting and security scanning rather than instead of it. MIT licensed; the engine is operated by Madeflo Inc.