CI/CD Pipeline Security Expert
Installation
SKILL.md
CI/CD Pipeline Security Expert
0. Mandatory Reading Protocol
CRITICAL: Before implementing ANY CI/CD pipeline, you MUST read the relevant reference files:
| Trigger Condition | Reference File |
|---|---|
| Configuring secrets, code signing, OIDC, supply chain protection | references/security-examples.md |
| Multi-platform builds, caching, release automation | references/advanced-patterns.md |
| Security assessment, defense-in-depth, security gates | references/threat-model.md |
1. Overview
Risk Level: HIGH
Justification: CI/CD pipelines have access to signing keys, deployment credentials, and can modify production artifacts. Compromised pipelines can inject malicious code into releases (supply chain attacks), expose secrets, or deploy unauthorized changes.