64 skills · sorted by relevance
Use when attacking or auditing a CI/CD pipeline or software supply chain — pwn requests, poisoned pipeline execution, compromised/mutable-tag actions, dependency confusion, registry worms, runner backdoors, OIDC trust abuse, SLSA/provenance
The English summary is being prepared. Showing the original description.
When the user needs to set up or improve CI/CD pipelines — GitHub Actions, GitLab CI, deployment automation, or says "set up CI", "automate deployment", "add tests to pipeline", "fix my build".
The English summary is being prepared. Showing the original description.
CI/CD pipeline attack hunting (GitHub Actions focus) - pwn requests (pull_request_target), script injection, self-hosted runner takeover, cache poisoning, OIDC-to-cloud token theft, poisoned pipeline execution. Wiki-first, FIND schema output.
The English summary is being prepared. Showing the original description.
CI/CD is the backbone of modern software delivery. Continuous Integration catches bugs early. Continuous Deployment gets features to users fast. But poorly designed pipelines can be slow, flaky, and a source of constant frustration. This skill covers GitHub Actions (the most popular), GitLab CI, and general pipeline design principles. The focus is on pipelines that are fast, reliable, and maintainable. 2025 reality: Your pipeline is infrastructure code. It deserves the same care as your application. A flaky test in CI is worse than no test - it teaches developers to ignore failures. Use when "github actions, gitlab ci, ci cd, pipeline, workflow, deploy automation, continuous integration, continuous deployment, build pipeline, yaml workflow, ci-cd, github-actions, gitlab-ci, devops, automation, deployment, pipelines" mentioned.
The English summary is being prepared. Showing the original description.
Designs and troubleshoots NUKE-based CI/CD pipelines for .NET services. Use when refactoring target graphs, splitting test flows, publishing reports, or diagnosing slow pipelines.
The English summary is being prepared. Showing the original description.
Endpoint defense evasion after an operator-selected chain already has a valid execution path but AV/EDR/AMSI/WDAC/PPL/memory/kernel telemetry blocks the intended action. Originating modules include /web-attack /ad-attack /cloud-attack /k8s /cicd /service-attack /phishing /privesc-win /privesc-linux /creds /post /shell. Success is the blocked action becoming executable, then resume the originating module — not obtaining a shell here.
The English summary is being prepared. Showing the original description.
CI/CD pipeline and software-supply-chain exploitation: Jenkins, GitHub Actions, GitLab CI/CD, Azure DevOps, Gitea/Forgejo, self-hosted runners/agents, poisoned pipeline execution, artifact/cache abuse, dependency confusion, third-party Action trust, GitOps/registry poisoning, workload identity/OIDC, and emerging agentic CI/CD. Use this skill when the operator has access to a CI/CD system, source repository, build/deploy configuration, runner/agent, artifact/package/registry path, or software delivery trust chain.
The English summary is being prepared. Showing the original description.
Standards for CI/CD pipelines using GitHub Actions workflows.
The English summary is being prepared. Showing the original description.
Scaffolds CI/CD pipeline definitions using GitHub Actions for build, test, lint, and deploy workflows.
The English summary is being prepared. Showing the original description.
Use when hunting CI/CD bot comment command vulnerabilities where issue_comment or pull_request_review_comment triggers invoke privileged workflows without verifying the commenter's identity or authorization. Trigger on: "bot command injection", "issue_comment trigger", "@github-actions", "slash command CI", "CI bot command", "comment triggered workflow", "unauthenticated bot", "github-actions publish", "comment dispatch", no authorization check on workflow_dispatch from comment, chatops CI/CD, supply chain via PR comment.
The English summary is being prepared. Showing the original description.
Use when an admin or partner needs to package an Experience Cloud (Community) site as a reusable Lightning Bolt Solution for distribution — covers the export workflow from Experience Builder, what gets bundled (ExperienceBundle, custom apps, flow categories, theme, layouts, navigation menus) versus what does NOT (data, CMS content, files), choosing Bolt vs managed package vs unlocked package vs cloning a site, sandbox-to-production promotion, multi-org distribution, AppExchange listing as a Bolt, and template versioning via the LightningBolt metadata `versionNumber`. Triggers: 'turn this community into a reusable template', 'package an Experience Cloud site to ship to multiple orgs', 'export Experience Builder template for AppExchange', 'should we use a Bolt or a managed package for this community', 'create an industry-specific community starter', 'how do we version our partner portal template', 'distribute branded Experience site across business units'. NOT for general Experience Cloud site build, content, or member setup (use admin/experience-cloud-site-setup, admin/experience-cloud-cms-content, admin/experience-cloud-member-management). NOT for shipping Apex / LWC / data-model functionality as a product (use devops/managed-package-development, devops/second-generation-managed-packages, devops/unlocked-package-development). NOT for moving a single Experience site between sandbox and prod as a one-off (use devops/experience-cloud-deployment-admin, devops/cicd-for-experience-cloud).
The English summary is being prepared. Showing the original description.
DevOps expert for building robust CI/CD pipelines with GitHub Actions, GitLab CI, Jenkins
The English summary is being prepared. Showing the original description.
Generates GitHub Actions CI workflow configuration
The English summary is being prepared. Showing the original description.
Cloudflare Pages CI/CD with preview environments, edge functions, and Wrangler automation. Activate on: Cloudflare Pages, Wrangler deploy, preview environment, edge function, Pages project, Cloudflare Workers integration, custom domain on Pages. NOT for: Worker-specific development (use cloudflare-worker-dev), DNS management (use devops-automator), full-stack app frameworks (use vercel-deployment).
The English summary is being prepared. Showing the original description.
Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.
The English summary is being prepared. Showing the original description.
GitHub Actions, GitLab CI, Jenkins, and automated deployment pipelines
The English summary is being prepared. Showing the original description.
Install or migrate BIRD 2/3 editor support and @birdcc/cli. Use for the BIRD2 LSP VS Code extension, the separate TextMate syntax extension or extension pack, VS Code forks, BIRD.nvim, BIRD.vim, manual Neovim LSP wiring, JetBrains TextMate bundles, birdcc CLI installation, offline VSIX setup, or migrations from BIRD2.nvim/BIRD2.vim. Route config diagnostics to bird-agent and GitHub Actions to birdcc-cicd.
The English summary is being prepared. Showing the original description.
Write, review, discover, lint, format, and validate BIRD 2/3 routing-daemon projects with the @birdcc toolchain. Use for bird.conf, bird2.conf, bird3.conf, bird6.conf, .bird/.bird2/.bird3 files, bird.config.json, birdcc.config.json, include graphs, BIRD filters and protocols, birdcc init/lint/fmt/lsp, or bird -p checks. Treat BIRD 1 as legacy and verify it with the actual BIRD 1 binary. Route editor and CLI installation to birdcc-installer, GitHub Actions to birdcc-cicd, runtime incidents to bird-troubleshooting, and implementation archaeology to bird-source-explorer.
The English summary is being prepared. Showing the original description.
Build or review GitHub Actions workflows for BIRD 2/3 projects using bird-chinese-community/setup-birdcc and @birdcc/cli. Use for pull-request lint/format/parse checks, BIRD2/BIRD3 matrices, BIRD_BIN, changed config files, pnpm/Turbo caching, submodule configs, action pinning, or .github/workflows changes. Route local config work to bird-agent and local editor/CLI installation to birdcc-installer.
The English summary is being prepared. Showing the original description.
You are a workflow automation expert specializing in creating efficient CI/CD pipelines, GitHub Actions workflows, and automated development processes. Design automation that reduces manual work, i...
The English summary is being prepared. Showing the original description.
Configure CI/CD stages, secrets model, and service-aware pipeline strategy with execution verification gate
The English summary is being prepared. Showing the original description.
bu skill covers implementing Gitleaks for Tespit etme and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for exposed credentials.
The English summary is being prepared. Showing the original description.
bu skill covers implementing Open Policy Agent (OPA) and Gatekeeper for policy-as-code enforcement in Kubernetes and CI/CD pipelines. It addresses writing Rego policies, Dağıt:ing OPA Gatekeeper as a Kubernetes admission controller, testing policies in development, and integrating policy evaluation into Dağıt:ment pipelines.
The English summary is being prepared. Showing the original description.
bu skill covers implementing automated security scanning for Infrastructure as Code (IaC) templates using tools like Checkov, tfsec, and KICS. It addresses Tespit etme misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Helm charts before Dağıt:ment, establishing policy-based governance, and integrating IaC scanning into CI/CD pipelines to prevent insecure cloud resource provisioning.
The English summary is being prepared. Showing the original description.