菜单
Orchestrate comprehensive CI/CD security reviews combining version comparison, control verification, risk analysis, and reporting. Use when running automated CI/CD pipeline security checks or when user requests full security assessment.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | ci-cd-verification |
| description | Orchestrate comprehensive CI/CD security reviews combining version comparison, control verification, risk analysis, and reporting. Use when running automated CI/CD pipeline security checks or when user requests full security assessment. |
This is a meta-workflow skill that orchestrates comprehensive CI/CD security reviews by combining version comparison, control verification, risk analysis, and reporting. Use this when you need a complete, automated security assessment.
Use ci-cd-verification when:
Use individual skills instead when:
compare-versionscountermeasure-verificationThis skill guides you through a multi-step workflow, calling other tools as needed:
Tool: compare_versions
Action: Compare baseline version against current/PR state
Output: Structured diff showing what changed
Tool: countermeasure_verification
Action: Verify countermeasures are correctly implemented
Condition: Only if PR/changes are linked to issue tracker tasks
Output: Implementation verification results
Action: Analyze comparison results for security implications
Process: Interpret structured diff, assess risk changes, identify critical issues
Action: Create human-readable security report
Output: Unified report covering all findings
# User: "Run full CI/CD security verification"
# The skill returns workflow guidance:
result = ci_cd_verification(baseline_version="v1.0-approved")
# You then execute the workflow:
# STEP 1: Architectural drift
version_diff = compare_versions(baseline_version="v1.0-approved")
diff = json.loads(version_diff)
# Analyze the diff
architecture_changes = diff['architecture']
security_changes = diff['security']
# STEP 2: Control verification (if applicable)
# Check if PR has issue tracker references
issue_refs = extract_issue_refs_from_git() # Your text parsing
if issue_refs:
cm_verification = countermeasure_verification(issue_references=issue_refs)
# Analyze and update test statuses
# STEP 3: Risk analysis
# Interpret the diffs, assess security impact
# STEP 4: Generate unified report
# Combine all findings into one comprehensive report
Always call this - it's the foundation of the security review
Call only if:
Skip if:
Always do this - synthesize findings into actionable report
Your final report should combine findings from all steps:
# 🚨 CI/CD Security Verification Report
## Executive Summary
- Overall risk level (CRITICAL/HIGH/MEDIUM/LOW)
- Key findings count
- Recommendation (APPROVE/REQUEST CHANGES/REJECT)
## Architectural Changes
[From compare_versions output]
- Components added/removed/modified
- Dataflows added/removed/modified
- Trust zone changes
## Security Impact
[From compare_versions output]
- New threats introduced
- Severity increases
- Countermeasures removed
- Risk indicators
## Control Implementation Verification
[From countermeasure_verification output - if applicable]
- Controls verified
- Implementation status (passed/failed)
- Evidence and findings
## Risk Delta Analysis
[Your interpretation]
- How do changes affect overall security posture?
- Relationship between architecture and security changes
- Critical issues requiring attention
## Recommendations
- What must be fixed before merge
- What should be addressed before production
- What documentation is needed
compare_versions (focused):
ci_cd_verification (comprehensive):
User: "What changed since baseline?"
You: Call compare_versions(baseline_version="baseline")
Interpret results, show summary
User: "Run CI/CD security checks"
You: Call ci_cd_verification(baseline_version="v1.0-approved")
Follow orchestration guidance
Call compare_versions
Call countermeasure_verification (if relevant)
Generate comprehensive report
User: "Did I implement PROJ-1234 correctly?"
You: Call countermeasure_verification(issue_references="PROJ-1234")
Analyze code vs countermeasure requirement
Update test status
Use this skill for comprehensive, automated CI/CD security reviews that combine multiple analyses into one thorough security assessment.
Analyze mixed repositories (application code + infrastructure + policies + docs) to extract ALL components for ONE unified threat model. Use when analyzing codebases with multiple source types for threat modeling. Architecture modeling only - do NOT identify vulnerabilities.
Step-by-step instructions for creating IriusRisk threat models (OTM files). Use when creating or updating threat models. Covers validation, component mapping, trust zones, and complete workflow from analysis to import.
Detailed guidance on OTM component layout and positioning. Use when creating initial layouts from scratch or updating existing layouts. Covers component sizes, spacing, nesting hierarchies, and cascading size calculations.
Analyze source code to answer IriusRisk questionnaires that refine threat models based on actual implementation. Use after creating threat model to reduce false positives and improve accuracy. Requires thorough code analysis.
Trigger point for architecture, design, or system structure reviews. Use when user asks to review architecture, design, or understand system structure. Guides you to check for existing threat models first.
Complete workflow instructions for IriusRisk threat modeling. Use when starting any threat modeling task. Provides decision logic for using existing threat models, creating new ones, and when to ask permission.