ci-cd

SUSPICIOUS. The skill is largely coherent and looks like a legitimate CI/CD documentation/reference skill, not credential-harvesting malware. However, it meaningfully enables autonomous deployment actions, forwards sensitive secrets to third-party GitHub actions and user-defined endpoints, and includes at least one insecure SSH pattern that disables host key checking; this makes it medium risk rather than benign.

The configuration does not contain clear malware or intentional sabotage. It does contain material CI/CD security risks: explicit secret exposure, disabled SSH host verification, unpinned remote CI inclusion, mutable dependency/image references, and potentially high-impact Docker-in-Docker and deployment credentials. Pin external templates and images, remove secret echoes, use file-type secret handling, enable strict host verification with a managed known_hosts file, quote and validate variables, isolate protected deployment jobs, and avoid duplicate job definitions.

The fragment contains conventional CI/CD workflows and no clear malicious behavior. It presents moderate supply-chain and CI security risk because third-party actions are not pinned immutably, package installation executes repository/dependency code, deployment secrets are used in production workflows, and changed filenames are interpolated into a shell command in the pull-request lint workflow. Temporary public Lighthouse storage may expose sensitive generated content. Review and harden these areas before relying on the workflows.

The visible fragment appears to be a legitimate deployment and rollback workflow. It does not show clear malicious behavior, credential theft, obfuscation, or unauthorized exfiltration. It carries moderate security and operational risk because it uses privileged SSH access, can reverse database migrations, invokes unseen scripts, and references third-party actions by mutable tags. Review the omitted scripts, pin actions to commit SHAs, restrict SSH and sudo permissions, and validate rollback procedures.