review-conf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited review-conf (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Review an ansible.cfg and produce a structured severity report. This command never modifies files.
Run discovery per references/discovery.md. Locate the ansible.cfg. Report which file will be reviewed.
Read and parse the ansible.cfg as an INI file. Identify all sections and key-value pairs.
## ansible.cfg Review: <path>
Reviewed: <timestamp>
Sections found: <list>
---
### CRITICAL
[Critical issues]
### WARNING
[Warnings]
### INFO
[Informational notes]
---
Summary: <X> critical, <Y> warnings, <Z> info| Check | Condition | Message |
|---|---|---|
| vault_password_file world-readable | vault_password_file path exists and is readable by others (check permissions) | [defaults] vault_password_file '<path>' may be world-readable — run: chmod 600 <path> |
| Inline vault password | vault_identity_list contains an inline password (not a file path) | [defaults] vault_identity_list contains what appears to be an inline password — use a file path instead |
| Deprecated accelerate | [accelerate] section present (removed in ansible-core 2.12) | [accelerate] Section removed in ansible-core 2.12 — remove this section entirely |
| forks extremely high | forks > 200 | [defaults] forks=<N> is dangerously high — each fork uses ~100MB RAM, risking OOM on controller |
| log_path world-writable | log_path is set to a world-writable directory (e.g., /tmp/ansible.log without restriction) | [defaults] log_path '<path>' is in a world-writable directory — logs may contain sensitive data |
| Check | Condition | Message |
|---|---|---|
| host_key_checking=False without comment | host_key_checking = False with no inline comment justifying it | [defaults] host_key_checking=False without justification comment — add a comment explaining the context (dev/CI/ephemeral runners) |
| Missing [privilege_escalation] | become = True set in [defaults] but no [privilege_escalation] section | [defaults] become=True is set but [privilege_escalation] section is absent — add the section for explicit configuration |
| Callbacks include awx_display manually | callbacks_enabled contains awx_display | [defaults] Do not add awx_display to callbacks_enabled — AWX injects it automatically and adding it causes duplicate output |
| fact_caching_connection has credentials | fact_caching_connection contains a password in the URL (redis://:password@...) | [defaults] fact_caching_connection contains credentials in plaintext — use an environment variable or vault-encrypted value |
| stdout_callback=debug | stdout_callback = debug | [defaults] stdout_callback=debug produces very verbose output — use yaml or minimal for normal operation |
| retry_files_enabled=True | retry_files_enabled = True (the default) | [defaults] retry_files_enabled is True (default) — consider setting to False to reduce filesystem noise |
| Deprecated squash_actions | squash_actions key present | [defaults] squash_actions was removed in ansible-core 2.8 — remove this setting |
| Deprecated any_errors_fatal at cfg level | any_errors_fatal in ansible.cfg (not a valid ansible.cfg setting) | [defaults] any_errors_fatal belongs in playbooks, not ansible.cfg |
| Missing collections_path | local collections exist but no collection path is configured | [defaults] ./collections/ directory exists but collections_path is not configured — add collections_path = ./collections |
| pipelining disabled | pipelining = False or not set | [ssh_connection] pipelining is disabled — enable it for significant performance improvement (requires Defaults:!requiretty in /etc/sudoers) |
| Check | Condition | Message |
|---|---|---|
| gathering=implicit | gathering = implicit (not smart) | [defaults] gathering=implicit re-gathers facts on every play — consider smart to use cached facts |
| forks at default | forks not set or = 5 | [defaults] forks defaults to 5 — increase for large inventories (e.g., forks=20) |
| No fact caching configured | fact_caching not set | [defaults] Fact caching not configured — consider jsonfile or redis for faster reruns |
| log_path not set | log_path absent | [defaults] log_path not set — consider enabling for audit trail (rotate with logrotate) |
| No vault config | Neither vault_password_file nor vault_identity_list is set | [defaults] No vault configuration — add vault_password_file or vault_identity_list if using ansible-vault |
| control_persist not set | control_persist absent | [ssh_connection] control_persist not set — add control_persist=60s for connection reuse |
/ansible-designer:update-conf to apply fixes."~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.