vm-config-detector

Skill detail with category, linked agents, and source metadata.

vm-config-detector

Discover and inventory security-relevant configuration files including web servers, databases, cloud providers, container orchestration, and CI/CD configs. Identifies potential security misconfigurations and sensitive data exposure. Use when mapping infrastructure configuration before security review. Returns config inventory with flags.

Category: Security & Compliance Used by 2 agents

Source: .github/skills/compliance/vm-config-detector/SKILL.md

Used By Agents

Preview

View source preview (first 3000 chars)


# Configuration Detector Skill

Discovers security-relevant configuration files and identifies potential misconfigurations.

## When to Use This Skill

- Mapping infrastructure configuration landscape
- Identifying exposed secrets in config files
- Detecting security-relevant configuration patterns
- Pre-security-review configuration inventory
- Understanding deployment architecture
- Finding cloud provider and CI/CD configurations

## Unitary Function

**ONE RESPONSIBILITY:** Discover and inventory security-relevant configuration files

**NOT RESPONSIBLE FOR:**
- Deep configuration security analysis (see security validation skills)
- Fixing misconfigurations (read-only skill)
- Source code analysis (see vm-codebase-analyzer)
- Dependency scanning (see vm-dependency-scanner)
- Runtime configuration (static analysis only)

## Input

```json
{
  "repository_path": "/path/to/codebase",
  "config_types": ["all"],
  "scan_depth": 3,
  "include_dotfiles": true,
  "check_secrets": true
}
```

**Parameters:**
- **repository_path** (required): Path to codebase root
- **config_types** (optional): `["all"]` or specific types like `["webserver", "database", "cloud"]`
- **scan_depth** (optional): Directory recursion depth (default: `3`)
- **include_dotfiles** (optional): Scan hidden files (default: `true`)
- **check_secrets** (optional): Flag potential secrets (default: `true`)

## Output

Configuration inventory with security flags (JSON format):

```json
{
  "scan_summary": {
    "timestamp": "2026-01-13T10:30:00Z",
    "configs_found": 27,
    "security_flags": 5,
    "critical_issues": 1,
    "scan_duration": "3s"
  },
  "configurations": [
    {
      "category": "webserver",
      "type": "nginx",
      "file": "nginx.conf",
      "path": "/etc/nginx/nginx.conf",
      "security_flags": [
        {
          "severity": "high",
          "issue": "SSL/TLS not enforced",
          "line": 45,
          "context": "listen 80 default_server;"
        }
      ],
      "recommendations": [
        "Enable HTTPS redirection",
        "Configure strong SSL ciphers",
        "Enable HSTS header"
      ]
    },
    {
      "category": "environment",
      "type": "env_file",
      "file": ".env",
      "path": ".env",
      "security_flags": [
        {
          "severity": "critical",
          "issue": "Hardcoded credentials detected",
          "line": 12,
          "context": "DATABASE_PASSWORD=admin123",
          "secret_type": "password"
        },
        {
          "severity": "high",
          "issue": "API key exposed",
          "line": 18,
          "context": "STRIPE_SECRET_KEY=sk_live_***",
          "secret_type": "api_key"
        }
      ],
      "recommendations": [
        "Use environment variables or secrets manager",
        "Add .env to .gitignore",
        "Rotate exposed credentials immediately"
      ]
    },
    {
      "category": "cloud",
      "type": "aws",
      "file": "terraform.tfvars",
      "path": "infrastructure/terraf