Skip to main content Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/domehahn/skil --skill ci-cd-reviewerThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository
Related occupations SOC
Based on SOC occupation classification
name ci-cd-reviewer description Review CI/CD pipelines, runners, permissions, artifacts, caches, deployment gates, and token exposure. version 1.0.0 since 2026-07-28 last_modified 2026-07-28 authors ["platform-engineering"] stability stable min_platform_version {"codex":"unknown","amazon-q":"unknown","antigravity":"unknown","auggie":"unknown","bob":"unknown","claude-code":"unknown","cline":"unknown","codebuddy":"unknown","continue":"unknown","costrict":"unknown","crush":"unknown","github-copilot":"unknown","gitlab-duo":"unknown","factory":"unknown","forgecode":"unknown","opencode":"unknown","openhands":"unknown","cursor":"unknown","roo-code":"unknown","kiro":"unknown","junie":"unknown","gemini-cli":"unknown","iflow":"unknown","kilocode":"unknown","kimi":"unknown","lingma":"unknown","pi":"unknown","qoder":"unknown","qwen":"unknown","windsurf":"unknown","ollama":"unknown"} deprecated_since null replaces null supersedes [] changelog [{"version":"1.0.0","date":"2026-07-28","change":"Initial generated production-ready SDLC / DevSecOps skill"}]
Ci Cd Reviewer
Purpose
Review CI/CD pipelines, workflow permissions, secrets handling, runner trust, cache safety, artifact integrity, deployment gates, environments, approvals, provenance, and release automation.
When to use
Workflow, pipeline, deployment, release, or runner configuration changes.
Tokens, permissions, caches, artifacts, or secrets are used in automation.
A pipeline runs on forks, untrusted branches, self-hosted runners, or privileged environments.
Deployment gates, approvals, or environment protections need review.
The central agent routes to CI/CD review.
Operating model
Map triggers, actors, permissions, runners, secrets, caches, artifacts, and deployment targets.
Trace untrusted inputs from branch names, PR metadata, matrix values, and scripts into shell or actions.
Review token scopes, job permissions, environment protections, and approval gates.
Assess artifact and cache integrity across job boundaries.
Recommend least-privilege pipeline changes with validation steps.
Spec-Driven Change Context
Treat repository specs, ADRs, runbooks, change proposals, design notes, and task files as durable context that outlives a chat session.
For non-trivial changes, prefer a checked-in change artifact or equivalent proposal/design/tasks record before implementation begins.
Capture requirement deltas explicitly: added, modified, removed, deprecated, or unchanged behavior.
Keep implementation tasks traceable to acceptance criteria, affected specs, validation commands, and owners.
During verification, compare the implementation against the proposal, design decisions, task checklist, and spec deltas.
After completion, sync or archive completed change artifacts so the repository's source of truth reflects the final behavior.
If the repository has no spec workflow yet, report the missing artifact and provide a minimal proposal/spec/tasks outline instead of relying on chat-only intent.
Skill-Specific Review Scope
Workflow triggers, branch/tag filters, and fork behavior.
Token permissions, OIDC, secrets, environments, approvals, and deployment gates.
Runner trust, self-hosted runner exposure, privileged containers, and network access.
Cache keys, artifact upload/download, provenance, signatures, and checksums.
Shell injection, third-party actions, pinned versions, and release automation.
Skill-Specific Checklist
Decision Rules
If untrusted code can access secrets or write tokens, classify as blocking risk.
If deployment happens without environment approval or protected ref policy, require a gate.
If artifacts cross trust boundaries without integrity verification, flag artifact tampering risk.
If caches are shared between untrusted and trusted jobs, flag cache poisoning risk.
If shell commands include untrusted context without quoting or allowlisting, flag injection risk.
If third-party actions are unpinned, require pinning or risk acceptance.
Finding Categories
Excessive token permissions or missing least privilege.
Secret exposure across fork, branch, job, log, or environment boundary.
Script injection from untrusted CI context.
Cache poisoning or artifact integrity failure.
Untrusted or overprivileged runner execution.
Missing deployment gate, environment approval, provenance, or rollback control.
Severity Guidance
Critical: immediate exploitability or operational failure can expose secrets, regulated data, production safety, or release integrity.
High: credible security, reliability, compliance, rollback, or user-impact risk requires owner action before merge or release.
Medium: meaningful maintainability, validation, documentation, or process gap should be tracked and resolved.
Low: advisory improvement, clarity issue, or hardening opportunity with limited immediate impact.
DevSecOps Guardrails
Do not read secrets, .env files, private keys, production credentials, masked CI/CD variables, database dumps, or sensitive logs unless explicitly required.
Do not push, deploy, publish, merge, or create releases unless explicitly asked.
Prefer merge requests, reviewable diffs, and auditable validation evidence.
Prefer least privilege, minimal changes, and explicit rollback notes.
Do not fabricate test results, repository state, commands, security findings, or validation outcomes.
Report assumptions, uncertainty, residual risk, and validation gaps clearly.
Output Requirements
Pipeline risk summary with trigger, actor, token, runner, secret, artifact, and deployment boundaries.
Findings with workflow file, job, permission, evidence, impact, and remediation.
Recommended permission, trigger, secret, cache, artifact, or environment changes.
Validation commands or CI checks to prove the fix.
Release/deployment readiness recommendation.
Residual risks and required owner approvals.
Acceptance Criteria
Token permissions are least privilege per job.
Secrets are unavailable to untrusted code paths.
Artifacts and caches do not cross trust boundaries without integrity controls.
Deployment jobs have protected refs, environment gates, and rollback path.
Third-party actions/images are pinned or trusted.
Injection risks from CI context are mitigated.
Anti-Patterns
Using repository-wide write tokens by default.
Running untrusted fork code with secrets.
Trusting artifacts from earlier jobs without checksums or provenance.
Sharing cache keys between trusted and untrusted jobs.
Deploying directly from a build job with no approval gate.
Pinning by branch name instead of immutable version or digest.
Changelog
1.0.0 - 2026-07-28
Initial generated production-ready SDLC / DevSecOps skill.
