ci-secure

ci-secure is an Application security skill for AI agents, published by starslingdev in the skills repository on GitHub. Skillspace rates ci-secure D (65/100) and it passed the safety scan; the rating is based on static analysis only.

Scans a repo's GitHub Actions workflows for the ten critical CI/CD attack vectors — template injection, fork code executed with privileges (pwn requests), cache poisoning, impostor action SHAs, secrets dumps, GITHUB_ENV hijack, write-token untrusted triggers, credentials in caches/artifacts, unverified remote code execution (curl|bash and mutable fetch-and-run), and dependency install scripts running in a job that holds secrets — reports every finding with a plain-English attacker scenario, plus pass/fail config hygiene checks, and fixes selected findings via per-finding subagents. Deliberately NOT comprehensive — critical exploit-chain checks only (references/why-these-ten.md). Use when: the user asks to audit or review CI/CD or GitHub Actions security posture, "is my CI secure", "audit my CI security", or names ci-secure / /ci-secure. Do NOT trigger for: CI speed, cost, or wall-clock audits ("why is CI slow") — use ci-speedup; CI config best-practices grading ("grade my CI", "CI…

Grade

D

Quality

65 / 100

Safety

Passed

GitHub stars

20

Unproven: rated by static analysis only, not yet compared head-to-head.

This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.