skills.rest
Shah-Aayush
Shah-AayushCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

ci-cd-supply-chain

Review CI/CD workflow files for security vulnerabilities and secret exposure.

Updated Aug 23, 2026
Search Tags:#security#risk assessment#ci-cd#workflows#codebase security
One-click install
npx skills add https://github.com/Shah-Aayush/pr-reviewer --skill ci-cd-supply-chain
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ci-cd-supply-chain
Source: https://github.com/Shah-Aayush/pr-reviewer/tree/main/shared-skills/security-axes/ci-cd-supply-chain
Command: npx skills add https://github.com/Shah-Aayush/pr-reviewer --skill ci-cd-supply-chain

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill meticulously examines CI/CD workflow files for potential security vulnerabilities and build-related risks, providing a first line of defense against compromised codebases.

Core Features & Use Cases

  • CI/CD Security Audit: Scans .github/workflows/, .pre-commit-config.yaml, Jenkinsfile, and more for security best practices.
  • Secret Exposure Detection: Flags any exposure of sensitive information in CI logs or scripts.
  • Untrusted Input Interpolation: Identifies potential shell injection vulnerabilities in workflow scripts.
  • Third-party Action Security: Reviews third-party actions for security issues like outdated versions or unknown publishers.
  • Use Case: For a development team managing CI/CD pipelines, this Skill helps ensure that workflows are secure, especially for repositories handling sensitive data.

Quick Start

Activate the ci-cd-supply-chain skill on a PR that includes changes to any workflow file to get a security audit of the CI/CD setup.

Frequently Asked Questions about ci-cd-supply-chain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check my GitHub Actions workflows for security vulnerabilities?▼

To check GitHub Actions workflows for security vulnerabilities, you can scan your .github/workflows/ files to detect secret exposure, untrusted input interpolation, and third-party action risks like outdated versions or unknown publishers.

What are common CI/CD pipeline security risks in Jenkinsfile and pre-commit configurations?▼

Common CI/CD pipeline security risks in Jenkinsfile and pre-commit configurations include secret exposure in build logs, shell injection from untrusted input interpolation, and vulnerabilities introduced by outdated or unverified third-party actions.

How do I detect shell injection vulnerabilities in CI/CD workflow scripts?▼

Detecting shell injection vulnerabilities in CI/CD workflow scripts requires scanning execution scripts and workflow files for untrusted input interpolation, ensuring external data is not passed directly into shell commands without proper sanitization.

Does CI/CD security auditing support both Jenkinsfile and GitHub Actions workflows?▼

Yes, CI/CD security auditing supports both Jenkinsfile and GitHub Actions workflows, scanning .github/workflows/ files, .pre-commit-config.yaml, and Jenkinsfile configurations to review third-party actions and identify potential security best practice violations.

What is the best way to audit third-party actions for security issues in a codebase?▼

The best way to audit third-party actions for security issues in a codebase is to review workflow files for outdated action versions, unknown publishers, and potential secret exposure, securing administrative software development pipelines.

When should I perform a CI/CD security audit on my repository workflows?▼

You should perform a CI/CD security audit on your repository workflows whenever a pull request includes changes to CI workflow files or execution scripts, ensuring new code does not introduce build-related risks or compromise sensitive data.

Related Skills

Explore More Software Engineering Skills→
nq-rdlnq-rdl

pre-commit

Manage multi-language pre-commit hooks from .pre-commit-config.yaml using pixi.

Official
Intermediate
dapperdiversdapperdivers
1

report-generator

Generate structured markdown penetration test reports from JSON security scan findings.

Community
Intermediate
martinholovskymartinholovsky
45

CI/CD Pipeline Security Expert

Automate CI/CD pipeline security hardening with GitHub Actions.

Community
Advanced
josavicentevwjosavicentevw
1

devsecops

Automate security scanning and governance across CI/CD pipelines and compliance workflows.

Community
Advanced