Claude code ansible skill
SaferSkills independently audited ansible-designer (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
AI-assisted Ansible authoring toolkit. Scaffolds, reviews, and updates Ansible projects with production-quality output following official ansible-core 2.15+ conventions.
All commands are top-level regardless of install path.
| Command | Description |
|---|---|
/new-playbook | Create a new playbook (site, component, or AWX-ready) |
/review-playbook | Review an existing playbook — severity report, no file modification |
/update-playbook | Update a playbook — shows diff, requires confirmation |
| Command | Description |
|---|---|
/new-role | Scaffold a complete role — asks about multi-OS support |
/review-role | Review a role — severity report, no file modification |
/update-role | Update a role — shows diff, requires confirmation |
| Command | Description |
|---|---|
/new-collection | Scaffold a new collection with galaxy.yml, plugins, roles structure |
/review-collection | Review a collection — severity report, no file modification |
/update-collection | Update a collection — shows diff, requires confirmation |
| Command | Description |
|---|---|
/new-conf | Generate an annotated ansible.cfg for dev, CI, or AWX |
/review-conf | Review an ansible.cfg — severity report, no file modification |
/update-conf | Update ansible.cfg — shows diff, requires confirmation |
Every sub-command enforces these rules without exception:
CLAUDE.md → ansible.cfg → README.md → filesystem scan. Build internal context (roles, collections, paths, namespace). Skip if user already provided all required parameters inline. See references/discovery.md.yes / y). Only write after confirmation.ansible.builtin.copy, never copy. ansible.builtin.service, never service. See references/best_practices.md.no_log: true. See references/security_vault.md.install, configure, service, validate, security, cleanup). No task may be untagged.review-* commands produce a structured severity report (CRITICAL / WARNING / INFO) only. They never write, modify, or suggest sed commands. Report only.update-* commands read the existing file, compute the change, show a unified diff, and wait for explicit confirmation before writing a single byte.references/testing.md.Every command follows this exact sequence:
Read: CLAUDE.md → ansible.cfg → README.md → filesystem scan
Build: internal context (roles_path, collections_path, existing roles, collections, inventory)
Report: "Discovery complete: [summary of what was found]"Skip Step 1 only if the user provided all required parameters inline.
--- original, +++ proposed).yes, y, or equivalent) before proceeding.references/ file as the base.Show file tree of all created/modified files.
Suggest: "Next step: [specific actionable suggestion]"| File | Used by |
|---|---|
references/discovery.md | All commands — Step 1 |
references/best_practices.md | All commands — FQCN, tags, no_log, idempotency |
references/playbook.md | new-playbook, review-playbook, update-playbook |
references/role.md | new-role, review-role, update-role |
references/collection.md | new-collection, review-collection, update-collection |
references/ansible_cfg.md | new-conf, review-conf, update-conf |
references/inventory.md | All commands — inventory context |
references/testing.md | All commands — validation and example test guidance |
references/security_vault.md | All commands — secret handling and vault-safe patterns |
references/plugins.md | Collection commands — module/filter/lookup guidance |
Install via the Claude Code marketplace from 3A2DEV/ansible-designer. This preserves the ansible-designer: namespace prefix for all sub-commands.
Requires Claude Code.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.