The Agent Skills Directory

[SAFE]: The skill provides standard GitLab CI/CD pipeline configurations and follows security best practices.
Secret Management: Sensitive credentials like $HARBOR_PASSWORD and $HARBOR_USERNAME are managed via environment variables rather than being hardcoded.
Trusted Infrastructure: Uses official and well-known container images such as node:alpine, alpine:latest, gcr.io/kaniko-project/executor:debug, and zricethezav/gitleaks:latest.
Security Tooling: Includes stages for static analysis and secret detection using tools like Semgrep, Gitleaks, and Hadolint.
False Positive Evaluation: A static analysis alert for a destructive system command (rm -rf) was evaluated as a false positive. The command is used within a Dockerfile to safely remove the npm CLI and its associated modules, which is a standard optimization practice to reduce the size and attack surface of production container images.

nextjs-monorepo-ci