1. Habit
  2. Skills
  3. CI/CD security skill
superagent-ai · 8K installs

CI/CD security skill
Runs by itself, workflow file changed.

Catch risky CI workflow changes.

Install the CI/CD security skill and make it a habit: follow https://gethabit.dev/skills/superagent-ai/ci-cd-security.md

  1. 1Copy
  2. 2Paste into Claude Code, Codex or Cursor
  3. 3It runs by itself

8K installs79 starsMIT licenceSource on GitHub ↗

CI/CD security

by superagent-ai · 8K installs

The skill

The ci/cd security skill reviews GitHub Actions workflow YAML for risky triggers, permissions, action pinning and injection patterns, with no tools to install, for maintainers hardening their pipelines.

Only when you ask.

The habit

Catch risky CI workflow changes.

↻ Runs by itselfworkflow file changed

How the habit works.
You don't have to.

Three questionsWhen does it start? How does it check its work? What does it remember?

01

It starts by itself

workflow file changed. Runs in GitHub Actions or Claude Code routine.

  • ↻ workflow file changed
  • pull_request paths .github/workflows/**

02

It checks its work

all passes walked. If a check fails, it tells you.

  • ✓all nine passes reported per file
  • ✓every finding has severity and file line
  • ✓no open P0 findings

03

It remembers

open findings list. The next run reads it first: open findings from earlier reviews.

loops/workflow-security-review-loop/findings.md

One run, step by step.
Then it stops.

Stop ruleStops after ten workflow files per run.

  1. 01

    Collect files

    Gather the changed files under .github/workflows/ from the pull request.

  2. 02

    Check triggers

    Review the on: block for risky triggers like pull_request_target and workflow_run.

  3. 03

    Check permissions

    Look for missing or broad permissions: blocks.

  4. 04

    Check pinning

    Review every uses: line for tag or branch pins.

  5. 05

    Check run blocks

    Look for untrusted values placed straight into run: scripts and fix them with env.

  6. 06

    Remaining passes

    Walk checkout, caching, artifacts, release and runner passes.

  7. 07

    Report

    List findings by severity, P0 first, with a rewrite, or say nothing fired and what was not checked.

What it may do.
Nothing more.

Safe by defaultIt writes only in its own folder and asks you before anything goes out.

Is it for you?
Use it when it fits.

Quick checkRead both lists. If the left one sounds like you, the CI/CD security skill helps.

Use it when

  • ✓ A pull request changes a workflow
  • ✓ You harden an open source repo
  • ✓ You ask about pull_request_target

Skip it when

  • – Your CI is not GitHub Actions
  • – You need org settings audited

Questions

CI/CD security skill, answered.

Does it install scanners?

No. The review is the model reading the YAML against fixed rules.

Does a clean scan mean my repo is safe?

No. Repo and org settings are outside the scan and need a separate check.

How do I install the CI/CD security skill?

Copy the prompt at the top into your agent. It installs the skill from superagent-ai/skills and sets up the habit. Or run npx skills add superagent-ai/skills --skill ci-cd-security.

Is the CI/CD security skill free?

Yes. It is published under MIT. Habit is free too.

CI/CD security. Now as a habit.

Install the CI/CD security skill and make it a habit: follow https://gethabit.dev/skills/superagent-ai/ci-cd-security.md

  • Free
  • No account
  • Undo in one line

All superagent-ai skills →More code skills →

Works in

  • Claude Code
  • Codex
  • Cursor
  • ChatGPT
  • Claude app

Made by superagent-ai, published under MIT. Habit links to the original and never changes it. Is this your skill?

Copying didn't work here. Select the line and copy it by hand.