UHC Environment and Secrets Reviewer

Use this skill to review UHC Mobile environment and secrets changes before they leak sensitive values or break environment-specific behavior.

Workflow

1. Inspect env files, config templates, native build settings, scripts, Firebase override paths, certificate pinning files, package docs, and any changed runtime config access.
2. Require secrets to flow through approved Vault-to-Artifactory or equivalent project-governed delivery, not source control, screenshots, local-only docs, or committed mocks.
3. Check react-native-config usage and environment selection so production, internal, test, and local builds cannot accidentally read the wrong values.
4. Check Firebase environment overrides for intentional scope and clear ownership.
5. Check certificate pinning and production domain changes for completeness across platforms and environments.
6. Check logs, errors, analytics, tests, fixtures, and documentation for accidental secret exposure.
7. Treat exposed credentials, disabled pinning, or production-domain mistakes as blocking findings.

Review Focus

• Secrets committed in env files, config files, scripts, tests, fixtures, docs, logs, or screenshots.
• Bypassed Vault-to-Artifactory or approved secret delivery flow.
• Incorrect react-native-config access or environment fallback behavior.
• Firebase override changes without environment scope and rollback clarity.
• Certificate pinning gaps, pinset drift, disabled validation, or mismatched UHC mobile domains.
• Production endpoints or credentials used in local, test, or internal-only paths without safeguards.

Output

• Lead with findings ordered by severity, with file and line references when possible.
• Separate blocking issues from high, medium, and low priority recommendations.
• Explain impact in mobile-user terms: security exposure, broken rollout, jank, inaccessible flow, analytics drift, build/runtime failure, or maintainability risk.
• Include specific remediation guidance. Keep code snippets small unless the user asks for an implementation.
• If no issues are found, say so clearly and note any meaningful test or verification gaps.

References

• references/review-guide.md: Migrated detailed review guide from the original mobile-ai-skills agent definition. Read it when you need the full checklist, example report shape, or grep patterns.