skills.rest
jaskaranhundal
jaskaranhundalCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pipeline-security-scan

Scan CI/CD pipeline configurations for security vulnerabilities and compliance.

3|3|Updated Mar 8, 2026
Search Tags:#ci/cd#devsecops#supply chain security#pipeline security#secrets scanning#artifact signing
One-click install
npx skills add https://github.com/jaskaranhundal/usap-skills --skill pipeline-security-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pipeline-security-scan
Source: https://github.com/jaskaranhundal/usap-skills/tree/main/appsec-devsecops/pipeline-security-scan
Command: npx skills add https://github.com/jaskaranhundal/usap-skills --skill pipeline-security-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill identifies security vulnerabilities within CI/CD pipeline configurations, ensuring that secrets are not exposed, essential security stages are present, artifacts are signed, and third-party actions are used securely.

Core Features & Use Cases

  • Secrets Detection: Scans pipeline YAML for hardcoded secrets in environment variables and step definitions.
  • Security Stage Audit: Verifies the presence and configuration of SAST, SCA, and secrets scanning stages.
  • Artifact Integrity Check: Assesses artifact signing, SBOM generation, and provenance attestation.
  • Use Case: A security engineer can use this skill to audit a new GitHub Actions workflow, ensuring it doesn't contain exposed API keys and includes necessary security scanning steps before being merged.

Quick Start

Run the pipeline security scan tool to analyze the current pipeline configuration and output findings in JSON format.

Frequently Asked Questions about pipeline-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan GitHub Actions workflows for exposed secrets and insecure third-party actions?▼

Scanning GitHub Actions workflows for exposed secrets involves analyzing pipeline YAML configurations to detect hardcoded environment variables. This process verifies secure third-party action usage and identifies vulnerabilities before deployment.

What pipeline security checks should I include for DevSecOps compliance in GitLab CI?▼

Pipeline security checks for DevSecOps compliance in GitLab CI include auditing for SAST, SCA, and secrets scanning stages. Validating artifact signing, SBOM generation, and provenance attestation ensures secure dependency management and artifact integrity.

Can I check my Jenkins pipeline for missing artifact signing and SBOM generation?▼

Yes, you can check Jenkins pipelines for missing artifact signing and SBOM generation by assessing the pipeline configurations. This validates artifact integrity, provenance attestation, and secure dependency management against DevSecOps best practices.

Does CircleCI configuration scanning detect hardcoded API keys in environment variables?▼

Yes, CircleCI configuration scanning detects hardcoded API keys by inspecting environment variables and step definitions within the pipeline YAML. This prevents secrets exposure and ensures sensitive credentials are not committed to version control.

What is the best way to audit Bitbucket Pipelines for supply chain security vulnerabilities?▼

The best way to audit Bitbucket Pipelines for supply chain security vulnerabilities is to analyze the configurations for insecure third-party action usage and missing security stages. This verifies compliance with DevSecOps best practices and validates artifact integrity.

Why do I need to validate artifact signing and provenance attestation in CI/CD pipelines?▼

Validating artifact signing and provenance attestation in CI/CD pipelines is needed to ensure artifact integrity and secure dependency management. This supply chain security measure prevents tampering and verifies the origin of build artifacts.

Related Skills

Explore More Software Engineering Skills→
Endor-Solutions-ArchitectureEndor-Solutions-Architecture
2

endor-cicd

Generate CI/CD security scanning configurations for GitHub Actions, GitLab CI, Jenkins, Azure DevOps, Bitbucket Pipelines, and CircleCI.

Official
Intermediate
SjdjdiejdrirhdkjejSjdjdiejdrirhdkjej

optimization-phase

Run post-implementation quality gates and generate reports before release.

Community
Advanced
ConnectiveTCSConnectiveTCS

devsecops-expert

Automate security gates for CI/CD pipelines across build, test, and deploy stages.

Community
Advanced
mostafasudomostafasudo
3

cso

Audit infrastructure security across secrets, dependencies, CI/CD, and AI systems.

Community
Advanced