ci-cd-review
- Repo stars 0
- Author repo skills-registry
Purpose
CI/CD review for workflows, artifact safety, caching, deployment gates, secrets, permissions, and reproducibility.
Review focus
- overbroad token permission
- unsafe shell
- missing gate
- cache poisoning
- non-reproducible build
- artifact leak
Method
- Inspect changed files and diff hunks relevant to this skill.
- Use repository-native tools when available.
- Prefer exact evidence from changed code.
- Emit findings using the shared JSONL finding contract.
- Avoid style-only comments unless they create maintainability or correctness risk.
Tooling hints
- Use
grepor editor search before opening files. - Use
git,grep, andghCLI. These are universally available and sufficient for all review tasks. - Do not depend on tools beyond
git,grep,cat,head,wc, andgh.
<!-- tomevault:4.0:skill_md:2026-05-22 -->Source: aydabd/github-bootstrap — distributed by TomeVault.
- Fluxly category
- DevOps
- Author-declared agents
- No explicit declaration found; this is not inferred or tested compatibility
- Static check
- 88 / 100 · heuristic scan, not runtime safety proof
- Author / version / license
- @tomevault-io · no license declared
- Fluxly token estimate
- Lean
- Fluxly setup estimate
- Guided setup
- External API key
- No requirement detected
- Detected OS requirements
- Unspecified
- Runtime requirements
- Unspecified
- Detected file/system behavior
-
- Read-only
- Write / modify
- Shell exec
- Detected network behavior
- Local-only
- Install commands
- None (reference only)
Profile is derived at build time from SKILL.md and install vectors. Subject to drift from author intent.
Heads up: 未限定 allowed-tools,默认拥有全部工具权限。
The current SKILL.md does not define a fixed output example. CI/CD review for workflows, artifact safety, caching, deployment gates, secrets, permissions, and reproducibility.
overbroad token permission unsafe shell missing gate
Inspect changed files and diff hunks relevant to this skill. Use repository-native tools when available. Prefer exact evidence from changed code.
Use grep or editor search before opening files. Use git, grep, and gh CLI. These are universally available and sufficient for all review tasks. Do not depend on tools beyond git, grep, cat, head, wc, and gh.
## Purpose
CI/CD review for workflows, artifact safety, caching, deployment gates, secrets, permissions, and reproducibility.
## Review focus
- overbroad token permission
- unsafe shell
- missing gate
- cache poisoning
- non-reproducible build
- artifact leak
## Method
1. Inspect changed files and diff hunks relevant to this skill.
2. Use repository-native tools when available.
3. Prefer exact evidence from changed code.
4. Emit findings using the shared JSONL finding contract.
5. Avoid style-only comments unless they create maintainability or correctness risk.
## Tooling hints
- Use `grep` or editor search before opening files.
- Use `git`, `grep`, and `gh` CLI. These are universally available and sufficient for all review tasks.
- Do not depend on tools beyond `git`, `grep`, `cat`, `head`, `wc`, and `gh`.
---
> Source: [aydabd/github-bootstrap](https://github.com/aydabd/github-bootstrap) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-05-22 --> Author text anchors workflow facts; Fluxly only indexes current sections, terms, files, and commands.
sections -> Purpose → Review focus → Method → Tooling hints
terms -> CI/CD review for workflows, artifact safety, caching, deployment gates, secrets, permissions, and reproducibility. · 1. Inspect changed files and diff hunks relevant to this skill. · - Use grep or editor search before opening files. · --- > Source: [aydabd/github-bootstrap](https://github.com/aydabd/github-bootstrap) — distributed by [TomeVault](https://tomevault.io).
files/cmd -> grep · git · cat · head
body sha256 -> bb8952f3c8e8
Decide Fit First
Design Intent
How To Use It
Boundaries And Review