cicd-security

仓库创建 2026年7月1日最近提交 23 天前SkillHot 收录 22 天前

▸ 精选理由

适用于审查或生成工作流文件，能阻止常见流水线风险。

这个 Skill 做什么

加固 CI/CD 流水线以防供应链攻击、密钥外泄与作业滥用。

给 CI/CD 流水线（如 GitHub Actions、GitLab CI）做安全加固，防止供应链攻击、密钥外泄与作业被滥用。常在编写或审查 workflow、引入第三方 action/镜像或接入云凭据时使用。关键措施包括固定第三方版本、最小化凭据权限并做运行时检测。

▸ 展开 SKILL.md 英文原文

Harden GitHub Actions, GitLab CI, and similar pipelines against supply-chain attacks, secret exfiltration, and pwn-request style abuses — Applies to: when authoring or reviewing CI/CD workflow files; when adding a third-party action / image / script to a pipeline; when wiring cloud or registry credentials into CI; when triaging a suspected pipeline compromise

开发编程CI/CD安全凭证防泄露供应链通用

Stars

Forks

仓库内 Skill

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/ShieldNet-360/secure-vibe/main/dist/agent-skills/.agents/skills/cicd-security/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/ShieldNet-360/secure-vibe/main/dist/agent-skills/.agents/skills/cicd-security/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. -->
<!-- Do not edit by hand; the source of truth is skills/cicd-security/SKILL.md. -->

# CI/CD Pipeline Security

Harden GitHub Actions, GitLab CI, and similar pipelines against supply-chain attacks, secret exfiltration, and pwn-request style abuses

## ALWAYS

- Pin every third-party GitHub Action by **commit SHA** (full 40-char), not by tag — tags can be re-pushed. Same applies to GitLab CI `include:` references and reusable workflows. Renovate / Dependabot can keep the SHA pins fresh.
- Declare `permissions:` at the workflow or job level and default to `contents: read` only. Gra

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有