themizeguy/cicd-expert-public (audit-pipeline-security)

This skill should be used when the user asks to "audit my pipeline security", "is my CI secure", "pipeline security review", "supply chain audit", "check my workflow security", "harden my CI", "SLSA compliance", "action pinning audit", "are my actions pinned", "CI security check", or "pipeline security". Runs a CI/CD pipeline security and supply chain audit checking permissions (least privilege, GITHUB_TOKEN scoping), action pinning (SHA vs tag, CVE-2025-30066), script injection (attacker-controlled context), fork PR safety (pull_request vs pull_request_target), secret management (environment vs repo vs org scoping, OIDC), supply chain (SLSA, Sigstore, SBOMs, attestations, Scorecard, StepSecurity), runner isolation (trust zoning, ephemeral vs persistent), and workflow scanning (zizmor, CodeQL for Actions). Produces a pass/fail assessment per category with concrete remediation.

Claude Skills are markdown + scripts loaded into Claude Code; scanned with the same pipeline.

Source:

github.com/themizeguy/cicd-expert-public

Provenance:

Found by crawling (provenance, not a security rating)

We found this by crawling public sources and nobody has attested to it. That is how most of the registry gets here, and it is not a mark against the artifact — it only means no authenticated act of publication is on record. An artifact can be the vendor's own and still appear here.