skills.rest
UnitOneAI
UnitOneAIOFFICIAL
Explore all skills by this author →
WebsiteGitHub

pipeline-security

Review CI/CD pipeline configurations for supply-chain and execution security gaps.

44|128|Updated Mar 6, 2026
Search Tags:#ci/cd#owasp#github actions#supply-chain#slsa#pipeline security#artifact integrity
One-click install
npx skills add https://github.com/UnitOneAI/SecuritySkills --skill pipeline-security-unitoneai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pipeline-security
Source: https://github.com/UnitOneAI/SecuritySkills/tree/main/skills/devsecops/pipeline-security
Command: npx skills add https://github.com/UnitOneAI/SecuritySkills --skill pipeline-security-unitoneai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you evaluate CI/CD pipeline configurations for supply-chain weaknesses and common pipeline risk patterns before they become exploitable.

Core Features & Use Cases

  • SLSA v1.0 build level determination to identify whether your build process meets L1, L2, or L3 expectations.
  • OWASP CI/CD Security Risks (CICD-SEC-1 through CICD-SEC-10) checks to surface insecure flow control, IAM gaps, dependency abuse, poisoned execution, and weak artifact integrity.
  • Prioritized remediation guidance that maps issues to concrete control IDs and actionable fixes during design reviews or configuration hardening.

Quick Start

Ask the skill to review your repository’s CI/CD pipeline configuration by pointing it at your target folder or workflow files.

Frequently Asked Questions about pipeline-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check my GitHub Actions workflow for supply-chain security risks?▼

To check GitHub Actions workflows for supply-chain security risks, review the CI/CD pipeline configurations to uncover execution gaps and apply SLSA v1.0 build-level evaluation and OWASP CICD-SEC controls for prioritized remediation.

What is SLSA v1.0 build level determination for CI/CD pipelines?▼

SLSA v1.0 build level determination evaluates whether your CI/CD build process meets L1, L2, or L3 supply-chain security expectations to identify artifact integrity and build provenance weaknesses.

Can I audit Jenkins pipeline configurations against OWASP CI/CD security controls?▼

Yes, you can audit Jenkins pipeline configurations against OWASP CI/CD security controls (CICD-SEC-1 through CICD-SEC-10) to surface insecure flow control, IAM gaps, dependency abuse, and poisoned execution.

How do I assess artifact integrity and dependency abuse in GitLab CI configs?▼

Assess artifact integrity and dependency abuse in GitLab CI configs by reviewing pipeline configurations for poisoned execution and weak artifact integrity, mapping issues to OWASP CICD-SEC control IDs for actionable fixes.

Does pipeline security review work for general supply-chain security across build and deploy phases?▼

Yes, pipeline security review works for general supply-chain security across build and deploy phases, applying injection-hardened safe processing to evaluate configurations and provide prioritized remediation guidance.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

supply-chain-cicd

Analyze CI/CD pipeline configurations for injection vectors, secret exposure, and access controls.

Community
Advanced
figulazmifigulazmi

web-security-testing

Assess web applications for OWASP Top 10 vulnerabilities and document findings.

Community
Advanced
jeremylongshorejeremylongshore
2.6k

scanning-container-security

Scan container images and running containers for vulnerabilities using Trivy or Snyk.

Community
Intermediate
yocxy2yocxy2

cso

Automate security audits and threat modeling for software repositories.

Community
Advanced