Skip to content
Back to skills

Setup Review

BSecurity

Review .ralph/config.json against the actual project and fix mismatches.

  • 38 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added February 10, 2026
toolspythongodjangoapi

Works with

  • cli
  • api

Security analysis

B84/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned February 12, 2026

npx -y skills add allierays/agentic-loop --skill setup-review --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Setup Review?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Setup Review
[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/allierays-setup-review/badge)](https://www.skillsdirectory.com/skills/allierays-setup-review)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
description: Review .ralph/config.json against the actual project and fix mismatches.
---

# Setup Review

Review `.ralph/config.json` and validate every setting against what actually exists in this project. Fix anything that's wrong.

## What to check

Read `.ralph/config.json`, then check each section against the real project files:

**1. commands.dev** — Does the dev command make sense?
- Check `package.json` scripts, `pyproject.toml`, `Makefile`, etc.
- Is the port in `urls.*` / `api.baseUrl` consistent with the dev command?

**2. commands.install** — Matches the actual package manager?
- `uv.lock` → `uv sync`, `poetry.lock` → `poetry install`, `pnpm-lock.yaml` → `pnpm install`, `yarn.lock` → `yarn install`, `package-lock.json` → `npm install`, `requirements.txt` → `pip install -r requirements.txt`

**3. checks.test / tests.\*** — Does the test runner exist?
- Check if `tests.directory` exists on disk
- Check if the test command actually works for this project (pytest, vitest, jest, go test, etc.)

**4. checks.lint** — Is the linter installed?
- Look for eslint, ruff, golangci-lint, clippy config files

**5. urls.\* / api.baseUrl** — Correct ports?
- Match ports to the dev command and any framework defaults

**6. paths.\* / tests.directory** — Do these directories exist?
- Check every path value against the filesystem

**7. playwright.\*** — Is Playwright actually set up?
- Check if `@playwright/test` is in package.json or playwright is pip-installed
- Does `playwright.testDir` exist?
- If Playwright isn't installed, set `playwright.enabled` to `false`

**8. migrations.\*** — Matches the actual migration tool?
- `prisma/` → prisma, `alembic/` or `alembic.ini` → alembic, `migrations/` + `manage.py` → Django, `priv/repo/migrations` → Ecto

**9. Python projects** — Correct package manager?
- `uv.lock` exists → commands should use `uv run`
- `poetry.lock` exists → commands should use `poetry run`
- Neither → plain `pip` / `python`

## How to fix

Edit `.ralph/config.json` directly to correct any mismatches.

## Output

Print a short summary. For each section, one line:
- What you checked
- Whether it was correct or what you changed

Keep it conversational — explain what each setting does in plain language so the user understands their config.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.