{"data":{"skill":{"slug":"sickn33-gitlab-ci-patterns","name":"gitlab-ci-patterns","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/gitlab-ci-patterns","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"0228a611-7c74-4da7-a801-977b4fe65b72","skill_id":"28064239-3a3c-469c-aea4-8f566239cdbd","version":5,"content_hash":"v3:88a8e9a07f4c54ab105c1c41b6267c287146b07b:3db01162900f11714490099556f560616ffbc65085b8c4bc88561c30f548e305:ceb1ce7206a9c25f1212bc3d1d2b2c66d906f7ae5eed20778b068cf4860d3fb8:736b696c6c732f7369636b6e33332f6769746c61622d63692d7061747465726e73:c3a22a82d342785a67461095a685fff0","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 22 static alerts are false positives caused by Markdown backticks, YAML fences, and reserved example.com deployment metadata. Semantic review found four genuine risks in the supplied pipeline patterns: disabled TLS verification, exposed password arguments, mutable images, and security scans that do not block failures.","remediation":[{"issue":"The Kubernetes example disables server certificate verification.","severity":"high","suggestion":"Provide the cluster CA certificate and remove --insecure-skip-tls-verify=true before configuring kubectl credentials."},{"issue":"The Docker login example passes the registry password as a command argument.","severity":"medium","suggestion":"Pipe the protected CI variable to docker login with --password-stdin, and keep the variable masked."},{"issue":"Several CI job images use mutable latest tags.","severity":"medium","suggestion":"Pin every external job image to a reviewed version or immutable digest, and update pins through a controlled process."},{"issue":"The Trivy security job permits pipeline success when the scan fails.","severity":"medium","suggestion":"Remove allow_failure or restrict it to an explicitly documented advisory stage with a separate blocking policy."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":89,"line_start":39},{"file":"SKILL.md","line_end":93,"line_start":89},{"file":"SKILL.md","line_end":109,"line_start":93},{"file":"SKILL.md","line_end":113,"line_start":109},{"file":"SKILL.md","line_end":146,"line_start":113},{"file":"SKILL.md","line_end":150,"line_start":146},{"file":"SKILL.md","line_end":194,"line_start":150},{"file":"SKILL.md","line_end":198,"line_start":194},{"file":"SKILL.md","line_end":210,"line_start":198},{"file":"SKILL.md","line_end":214,"line_start":210},{"file":"SKILL.md","line_end":242,"line_start":214},{"file":"SKILL.md","line_end":246,"line_start":242},{"file":"SKILL.md","line_end":262,"line_start":246},{"file":"SKILL.md","line_end":266,"line_start":262},{"file":"SKILL.md","line_end":267,"line_start":266},{"file":"SKILL.md","line_end":284,"line_start":267},{"file":"SKILL.md","line_end":285,"line_start":284},{"file":"SKILL.md","line_end":286,"line_start":285}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":130,"line_start":130},{"file":"SKILL.md","line_end":142,"line_start":142}]}],"critical_findings":[],"high_findings":[{"title":"Kubernetes TLS Verification Disabled","locations":[{"file":"SKILL.md","line_end":120,"line_start":117}],"confidence":0.98,"description":"The deployment pattern sets --insecure-skip-tls-verify=true before configuring a bearer token. A network attacker could impersonate the cluster API and capture credentials.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The flag explicitly disables certificate verification in the same setup that installs the cluster token. The resulting interception risk is direct and well understood."}],"medium_findings":[{"title":"Registry Password Passed as Command Argument","locations":[{"file":"SKILL.md","line_end":100,"line_start":100}],"confidence":0.95,"description":"The Docker login pattern supplies CI_REGISTRY_PASSWORD through the -p argument. Command arguments can expose secrets through process inspection or diagnostic output.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The password variable is visibly placed in a command argument. Docker provides --password-stdin specifically to avoid this exposure."},{"title":"Mutable CI Job Images","locations":[{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":206,"line_start":206}],"confidence":0.96,"description":"Three jobs pull images tagged latest. Mutable images can change without review, causing unexpected behavior or importing a compromised upstream release.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"Each cited image reference explicitly uses the latest tag. The same file advises using specific tags, confirming these examples violate its stated practice."},{"title":"Security Scan Cannot Block the Pipeline","locations":[{"file":"SKILL.md","line_end":209,"line_start":204}],"confidence":0.94,"description":"The Trivy command fails on high or critical findings, but allow_failure permits the pipeline to continue. Vulnerable images can therefore proceed to later jobs.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The scan requests a nonzero exit for severe findings, while allow_failure explicitly makes that result non-blocking. The policy conflict is visible in one job."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":292,"audit_model":"codex","audited_at":"2026-07-24T00:12:40.373+00:00","created_at":"2026-07-26T13:24:07.032761+00:00","static_findings":[{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If detailed examples are required, open `resources/implementation-playbook.md`.","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":89,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":93,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":109,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":113,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":146,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":150,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":194,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":198,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":210,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":214,"severity":"medium","line_start":210},{"id":"external_commands:SKILL.md:214:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":242,"severity":"medium","line_start":214},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":246,"severity":"medium","line_start":242},{"id":"external_commands:SKILL.md:246:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":262,"severity":"medium","line_start":246},{"id":"external_commands:SKILL.md:262:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":266,"severity":"medium","line_start":262},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `assets/gitlab-ci.yml.template` - Complete pipeline template","category":"external_commands","line_end":267,"severity":"medium","line_start":266},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `references/pipeline-stages.md` - Stage organization patterns","category":"external_commands","line_end":284,"severity":"medium","line_start":267},{"id":"external_commands:SKILL.md:284:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `github-actions-templates` - For GitHub Actions","category":"external_commands","line_end":285,"severity":"medium","line_start":284},{"id":"external_commands:SKILL.md:285:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `deployment-pipeline-design` - For architecture","category":"external_commands","line_end":286,"severity":"medium","line_start":285},{"id":"network:SKILL.md:88:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"url: https://app.example.com","category":"network","line_end":88,"severity":"low","line_start":88},{"id":"network:SKILL.md:130:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"url: https://staging.example.com","category":"network","line_end":130,"severity":"low","line_start":130},{"id":"network:SKILL.md:142:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"url: https://app.example.com","category":"network","line_end":142,"severity":"low","line_start":142}],"finding_verdicts":[{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"Line 23 uses Markdown backticks to format a referenced file path. It is prose and does not execute a Ruby or shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"Line 39 is the opening delimiter for a fenced YAML example. The backticks are Markdown syntax, not shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"Line 89 closes a fenced YAML example. It contains no executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"Line 93 opens a fenced YAML example for a GitLab job. Markdown fencing does not invoke a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"Line 109 is only the closing Markdown fence for the Docker pipeline example. No backtick execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"Line 113 starts a fenced YAML configuration example. The static pattern has mistaken Markdown syntax for command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"Line 146 closes the multi-environment YAML example. The delimiter is passive documentation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"Line 150 opens a fenced Terraform pipeline example written as YAML. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"Line 194 is the closing Markdown fence for the Terraform example. It does not execute the documented commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"Line 198 opens a fenced YAML security-scanning example. The three backticks only control Markdown formatting.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","reason":"Line 210 closes a YAML code fence and contains no command expression. The alert is caused by Markdown punctuation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:214:ruby-shell-backtick-execution","reason":"Line 214 begins a fenced cache configuration example. The backticks are documentation syntax only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","reason":"Line 242 is a closing Markdown fence. It has no executable content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:246:ruby-shell-backtick-execution","reason":"Line 246 opens a fenced YAML child-pipeline example. It is passive Markdown, not a shell backtick construct.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:262:ruby-shell-backtick-execution","reason":"Line 262 closes the child-pipeline code fence. The delimiter does not run the preceding example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","reason":"Line 266 formats a referenced template path with inline Markdown backticks. It does not perform command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","reason":"Line 267 formats a reference file path with inline Markdown backticks. No execution behavior is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:284:ruby-shell-backtick-execution","reason":"Line 284 uses backticks to format a related skill name. This is an inline Markdown label, not a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:285:ruby-shell-backtick-execution","reason":"Line 285 formats another related skill name with Markdown backticks. It has no executable semantics.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:88:hardcoded-url","reason":"The URL is reserved example.com metadata for a sample GitLab environment. The skill does not connect to it or transmit data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:130:hardcoded-url","reason":"The staging.example.com value is a reserved placeholder in documented environment metadata. It is not an operational network destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:142:hardcoded-url","reason":"The app.example.com value is a reserved placeholder for the production environment link. No request or data transfer is implemented.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Kubernetes TLS Verification Disabled","severity":"high","locations":[{"file":"SKILL.md","line_end":120,"line_start":117}],"confidence":0.98,"description":"The deployment pattern sets --insecure-skip-tls-verify=true before configuring a bearer token. A network attacker could impersonate the cluster API and capture credentials.","confidence_reasoning":"The flag explicitly disables certificate verification in the same setup that installs the cluster token. The resulting interception risk is direct and well understood."},{"title":"Registry Password Passed as Command Argument","severity":"medium","locations":[{"file":"SKILL.md","line_end":100,"line_start":100}],"confidence":0.95,"description":"The Docker login pattern supplies CI_REGISTRY_PASSWORD through the -p argument. Command arguments can expose secrets through process inspection or diagnostic output.","confidence_reasoning":"The password variable is visibly placed in a command argument. Docker provides --password-stdin specifically to avoid this exposure."},{"title":"Mutable CI Job Images","severity":"medium","locations":[{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":206,"line_start":206}],"confidence":0.96,"description":"Three jobs pull images tagged latest. Mutable images can change without review, causing unexpected behavior or importing a compromised upstream release.","confidence_reasoning":"Each cited image reference explicitly uses the latest tag. The same file advises using specific tags, confirming these examples violate its stated practice."},{"title":"Security Scan Cannot Block the Pipeline","severity":"medium","locations":[{"file":"SKILL.md","line_end":209,"line_start":204}],"confidence":0.94,"description":"The Trivy command fails on high or critical findings, but allow_failure permits the pipeline to continue. Vulnerable images can therefore proceed to later jobs.","confidence_reasoning":"The scan requests a nonzero exit for severe findings, while allow_failure explicitly makes that result non-blocking. The policy conflict is visible in one job."}],"subject_marketplace_commit_sha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","subject_content_hash":"3db01162900f11714490099556f560616ffbc65085b8c4bc88561c30f548e305","subject_tree_hash":"ceb1ce7206a9c25f1212bc3d1d2b2c66d906f7ae5eed20778b068cf4860d3fb8","subject_plugin_path":"skills/sickn33/gitlab-ci-patterns","audit_payload_hash":"c3a22a82d342785a67461095a685fff0","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","contentHash":"3db01162900f11714490099556f560616ffbc65085b8c4bc88561c30f548e305","treeHash":"ceb1ce7206a9c25f1212bc3d1d2b2c66d906f7ae5eed20778b068cf4860d3fb8","pluginPath":"skills/sickn33/gitlab-ci-patterns","auditPayloadHash":"c3a22a82d342785a67461095a685fff0"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-gitlab-ci-patterns/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":4,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}