Vet

Point it at a template you are thinking of installing, or at one already running alongside you, and it goes looking for trouble: buried directives, permissions wider than the stated job needs, routines that fire with nobody watching. The verdict comes back as a plain approve or flag.