agentskills.codes
CI

ci-security-compliance

by camundaSecuritySource

Enforces CI/CD security standards and secret management rules for the repository.

CI/CDSecurity Audit

Install

mkdir -p .claude/skills/ci-security-compliance && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/12189" && unzip -o skill.zip -d .claude/skills/ci-security-compliance && rm skill.zip

Installs to .claude/skills/ci-security-compliance

Activation

This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.

Enforces GitHub Actions security and compliance for this monorepo. Use when adding third-party actions, handling secrets, defining permissions, and reviewing CI security trade-offs.
181 chars✓ has a “when” trigger
Intermediate

Key capabilities

  • →Verify necessity of third-party GitHub Actions
  • →Check allowlist for approved actions
  • →Pin commit SHAs for third-party actions
  • →Configure GitHub Actions permissions with least privilege
  • →Manage secrets using Vault for GitHub Actions

How it works

The skill enforces security and compliance for GitHub Actions by verifying third-party actions against an allowlist, pinning SHAs, applying least privilege permissions, and mandating Vault for secret management.

Inputs & outputs

You give it
Proposed third-party GitHub Actions, secret configurations, or permission definitions
You get back
Validated GitHub Actions workflows adhering to security and compliance standards

When to use ci-security-compliance

  • →Verify CI security
  • →Add action to allowlist
  • →Configure secure CI secrets
  • →Review security trade-offs

About this skill

CI Security and Compliance Skill

Consult docs/monorepo-docs/ci.md before decisions.

Third-Party Action Review Flow

  1. Verify necessity and alternatives.
  2. Check allowlist in docs/monorepo-docs/ci.md (CI Security section).
  3. Present both options:
    • Option A: approved actions only
    • Option B: unapproved candidate with security assessment
  4. If unapproved action is accepted:
    • Add to allowlist in alphabetical order
    • Pin commit SHA in workflow
    • Request DRI review if trustworthiness is unclear

Never silently drop unapproved but relevant options.

Permissions Rules

Start with:

permissions: {}

Add only required scopes.

Secret Management

Vault is mandatory. GitHub Secrets are only for Vault bootstrap values:

  • VAULT_ADDR
  • VAULT_ROLE_ID
  • VAULT_SECRET_ID

Boundaries

  • Always: least privilege, SHA pinning, Vault usage, explicit trade-offs
  • Ask first: OIDC trust boundaries, new deployment targets
  • Never: embedded credentials, broad permissions, untrusted curl | bash

Reference

  • Allowed action guidance: references/approved-actions.md

When not to use it

  • →When embedding credentials directly in workflows
  • →When using broad permissions without justification
  • →When executing untrusted curl | bash commands

Limitations

  • →GitHub Secrets are only for Vault bootstrap values
  • →All third-party actions must be on an allowlist or undergo a security assessment
  • →Permissions must start with an empty set and add only required scopes

How it compares

This skill provides a structured framework for CI security, automating checks and enforcing policies that go beyond basic GitHub Actions configurations.

Compared to similar skills

ci-security-compliance side by side with the closest alternatives in the catalog.

SkillInstallsUpdatedSafetyDifficulty
ci-security-compliance (this skill)02moReviewIntermediate
secrets-management53moReviewAdvanced
security-scanning-security-hardening34moNo flagsAdvanced
sast-configuration33moReviewIntermediate

Try saying

Example prompts that trigger this skill in your AI assistant.

More by camunda

View all by camunda →

frontend-feature

camunda

Use when building or modifying pages, components, modules, routes, data loading, forms, API integration, or UI features — including small changes like a column, filter, or panel — in the orchestration cluster webapp (webapp/client/apps/orchestration-cluster-webapp/).

00

You might also like

secrets-management

wshobson

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

585

security-scanning-security-hardening

sickn33

Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.

333

sast-configuration

wshobson

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

327

dependency-auditor

alirezarezvani

Check dependencies for known vulnerabilities using npm audit, pip-audit, etc. Use when package.json or requirements.txt changes, or before deployments. Alerts on vulnerable dependencies. Triggers on dependency file changes, deployment prep, security mentions.

16

mcp-security-scan

cisco-ai-defense

Scans MCP servers, tools, prompts, and resources for security vulnerabilities using YARA rules, LLM analysis, and Cisco AI Defense API. Use this skill when the user wants to check MCP servers for security issues, detect prompt injection, tool poisoning, or analyze MCP configurations for threats.

14

fix-cves

okteto

Fix all CVEs in the Okteto CLI Docker image by scanning with Trivy and updating vulnerable dependencies and binaries

12

Search skills

Search the agent skills registry