pipeline-security-scan

Scan CI/CD pipeline configurations for security vulnerabilities and compliance.

3|3|Updated Mar 8, 2026

Search Tags:#ci/cd #devsecops #supply chain security #pipeline security #secrets scanning #artifact signing

Ready to run

npx skills add https://github.com/jaskaranhundal/usap-skills --skill pipeline-security-scan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pipeline-security-scan
Source: https://github.com/jaskaranhundal/usap-skills/tree/main/appsec-devsecops/pipeline-security-scan
Command: npx skills add https://github.com/jaskaranhundal/usap-skills --skill pipeline-security-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill identifies security vulnerabilities within CI/CD pipeline configurations, ensuring that secrets are not exposed, essential security stages are present, artifacts are signed, and third-party actions are used securely.

Core Features & Use Cases

Secrets Detection: Scans pipeline YAML for hardcoded secrets in environment variables and step definitions.
Security Stage Audit: Verifies the presence and configuration of SAST, SCA, and secrets scanning stages.
Artifact Integrity Check: Assesses artifact signing, SBOM generation, and provenance attestation.
Use Case: A security engineer can use this skill to audit a new GitHub Actions workflow, ensuring it doesn't contain exposed API keys and includes necessary security scanning steps before being merged.

Quick Start

Run the pipeline security scan tool to analyze the current pipeline configuration and output findings in JSON format.

Frequently Asked Questions about pipeline-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan GitHub Actions workflows for exposed secrets and insecure third-party actions?▼

Scanning GitHub Actions workflows for exposed secrets involves analyzing pipeline YAML configurations to detect hardcoded environment variables. This process verifies secure third-party action usage and identifies vulnerabilities before deployment.

What pipeline security checks should I include for DevSecOps compliance in GitLab CI?▼

Pipeline security checks for DevSecOps compliance in GitLab CI include auditing for SAST, SCA, and secrets scanning stages. Validating artifact signing, SBOM generation, and provenance attestation ensures secure dependency management and artifact integrity.

Can I check my Jenkins pipeline for missing artifact signing and SBOM generation?▼

Yes, you can check Jenkins pipelines for missing artifact signing and SBOM generation by assessing the pipeline configurations. This validates artifact integrity, provenance attestation, and secure dependency management against DevSecOps best practices.

Does CircleCI configuration scanning detect hardcoded API keys in environment variables?▼

Yes, CircleCI configuration scanning detects hardcoded API keys by inspecting environment variables and step definitions within the pipeline YAML. This prevents secrets exposure and ensures sensitive credentials are not committed to version control.

What is the best way to audit Bitbucket Pipelines for supply chain security vulnerabilities?▼

The best way to audit Bitbucket Pipelines for supply chain security vulnerabilities is to analyze the configurations for insecure third-party action usage and missing security stages. This verifies compliance with DevSecOps best practices and validates artifact integrity.

Why do I need to validate artifact signing and provenance attestation in CI/CD pipelines?▼

Validating artifact signing and provenance attestation in CI/CD pipelines is needed to ensure artifact integrity and secure dependency management. This supply chain security measure prevents tampering and verifies the origin of build artifacts.