ICP Deploy Check / aeon skill
Pre-deploy safety checklist for an
Pre-deploy safety checklist for an Internet Computer Rust canister - read a local/cloned canister repo and verify the deploy-time footguns from the canister-security checklist (controller backup, anonymous-principal rejection, no mainnet fetch_root_key, upgrade safety) before it ships. Static, read-only, no network and no mainnet action.
- Skill
- ICP Deploy Check
icp-deploy-check - Category
- Dev & Code
- Default schedule
- On demand
- Last updated
commit ae89317- Source
- aeonfun/aeon/skills/icp-deploy-check/SKILL.md MIT licensed, one prompt file
What it does
ICP Deploy Check is an aeon skill: Pre-deploy safety checklist for an Internet Computer Rust canister - read a local/cloned canister repo and verify the deploy-time footguns from the canister-security checklist (controller backup, anonymous-principal rejection, no mainnet fetch_root_key, upgrade safety) before it ships. Static, read-only, no network and no mainnet action. Like every aeon skill it is one SKILL.md prompt file that runs unattended on your own GitHub Actions, on a schedule or when you trigger it, and sends what it finds to Telegram, Discord, Slack or email.
The most expensive IC mistakes are set at deploy time and hard to undo: a single controller with no backup, an admin method reachable by the anonymous principal, a fetch_root_key() left on a mainnet path, or an upgrade that traps and strands the canister. This skill is the pre-flight checklist - a fast, static, read-only gate the operator runs before dfx deploy / icp canister install, so those footguns are caught on a workstation, not in production. It is the deploy-time sibling of the deeper canister-audit skill (which forks, scans, and PoC-verifies); this one just reads the repo in front of you and reports pass/fail per check.
Input: the var setting
Every aeon skill takes one optional text input, var, set in aeon.yml or typed in when you run it by hand. It picks the target or the mode for that run.
Path to a local canister repo/dir to check (default .). Pass fixture:token_vault to run against the bundled canister-audit fixture as a reproducible demo. This skill reads source only - it never deploys, calls mainnet, or needs an identity.
What it needs
No extra API keys or MCP servers. It runs on the model you connected to aeon (a Claude subscription token, an API key, or another login).
Install and run it
Easiest: open Aeon Connect, sign in with GitHub and turn on ICP Deploy Check. No clone, no terminal. To add it to an existing aeon repo from a shell, run:
Then switch it on in aeon.yml (the default schedule is filled in):
skills:
icp-deploy-check: { enabled: true, schedule: "workflow_dispatch", var: "" }New to aeon? Read the docs for how skills, schedules and memory fit together, or browse all skills.