📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills gitlab-ci-patterns
📦
gitlab-ci-patterns
Content revision r2 High Risk ⚙️ External commands🌐 Network access
Build Reliable GitLab CI/CD Pipelines
Complex GitLab pipelines are difficult to structure, cache, and secure. This skill provides reusable patterns for testing, containers, Terraform, Kubernetes, and deployment.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "gitlab-ci-patterns" from https://skillstore.io/skills/sickn33-gitlab-ci-patterns.md and its manifest at https://skillstore.io/api/skills/sickn33-gitlab-ci-patterns/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "gitlab-ci-patterns". Create a Node.js pipeline with build, test, cache, and artifacts.
Expected outcome:
- A three-stage pipeline separates compilation, validation, and delivery.
- The cache is scoped by branch, while build outputs use short-lived artifacts.
- Coverage results are published for merge request review.
Using "gitlab-ci-patterns". Add safe Docker publishing for main and tagged releases.
Expected outcome:
- The registry login reads a masked variable through standard input.
- Commit images use immutable commit tags, and release tags require protected refs.
- The build image and service are pinned to reviewed versions.
Using "gitlab-ci-patterns". Plan staging and production Kubernetes deployments.
Expected outcome:
Staging deploys after validation. Production requires protected credentials, verified cluster certificates, successful security checks, and manual approval.
Security Audit
High Riskv5 • 7/24/2026 Open versioned report
All 22 static alerts are false positives caused by Markdown backticks, YAML fences, and reserved example.com deployment metadata. Semantic review found four genuine risks in the supplied pipeline patterns: disabled TLS verification, exposed password arguments, mutable images, and security scans that do not block failures.
1
Files scanned
292
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Kubernetes TLS Verification Disabled
The deployment pattern sets --insecure-skip-tls-verify=true before configuring a bearer token. A network attacker could impersonate the cluster API and capture credentials.
The flag explicitly disables certificate verification in the same setup that installs the cluster token. The resulting interception risk is direct and well understood.
Medium
Registry Password Passed as Command Argument
The Docker login pattern supplies CI_REGISTRY_PASSWORD through the -p argument. Command arguments can expose secrets through process inspection or diagnostic output.
The password variable is visibly placed in a command argument. Docker provides --password-stdin specifically to avoid this exposure.
Medium
Mutable CI Job Images
Three jobs pull images tagged latest. Mutable images can change without review, causing unexpected behavior or importing a compromised upstream release.
Each cited image reference explicitly uses the latest tag. The same file advises using specific tags, confirming these examples violate its stated practice.
Medium
Security Scan Cannot Block the Pipeline
The Trivy command fails on high or critical findings, but allow_failure permits the pipeline to continue. Vulnerable images can therefore proceed to later jobs.
The scan requests a nonzero exit for severe findings, while allow_failure explicitly makes that result non-blocking. The policy conflict is visible in one job.
Risk Factors
⚙️ External commands (19)
SKILL.md:23 SKILL.md:39-89 SKILL.md:89-93 SKILL.md:93-109 SKILL.md:109-113 SKILL.md:113-146 SKILL.md:146-150 SKILL.md:150-194 SKILL.md:194-198 SKILL.md:198-210 SKILL.md:210-214 SKILL.md:214-242 SKILL.md:242-246 SKILL.md:246-262 SKILL.md:262-266 SKILL.md:266-267 SKILL.md:267-284 SKILL.md:284-285 SKILL.md:285-286
🌐 Network access (3)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-gitlab-ci-patterns/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-gitlab-ci-patterns?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-gitlab-ci-patterns?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-gitlab-ci-patterns/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-gitlab-ci-patterns.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). gitlab-ci-patterns security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-gitlab-ci-patterns/audits/5BibTeX citation
@techreport{sickn33-sickn33-gitlab-ci-patterns-2026,
author = {sickn33},
title = {gitlab-ci-patterns security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-gitlab-ci-patterns/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gitlab-ci-patterns security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-24"
url: "https://skillstore.io/skills/sickn33-gitlab-ci-patterns/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-gitlab-ci-patterns:audit:5"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Highest Skillstore Score
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
wshobson Recommended
wshobson-gitlab-ci-patterns
Skillstore Score 69
Evidence Confidence High
Skillstore usage 19
Updated
2026-08-21
sickn33 Current
sickn33-gitlab-ci-patterns
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 11
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Standardize Application Pipelines
Create consistent build, test, cache, artifact, and deployment stages for a GitLab-hosted application.
Design Infrastructure Delivery
Combine Terraform planning with controlled Kubernetes deployments across staging and production environments.
Strengthen Pipeline Security
Add GitLab security templates and container scanning while reviewing secrets, image pins, and failure policies.
Try These Prompts
Create a Basic Pipeline
Create a GitLab CI pipeline for my Node.js project. Include build, lint, test, cache, coverage, and artifact jobs.
Add Container Publishing
Extend my pipeline to build and publish Docker images. Pin tools, use password-stdin, and tag commits without overwriting trusted releases.
Deploy Across Environments
Design staging and production Kubernetes jobs. Require verified TLS, protected credentials, environment tracking, and a manual production approval.
Design an Advanced Delivery Workflow
Create a GitLab workflow with Terraform plans, blocking security scans, immutable images, and generated child pipelines. Explain trust boundaries and approval gates.
Best Practices
- Pin external images and tools to reviewed versions or immutable digests.
- Store secrets in protected, masked variables and avoid command-line password arguments.
- Require blocking validation and manual approval before production changes.
Avoid
- Do not disable TLS certificate verification for Kubernetes API connections.
- Do not treat mutable latest tags as reproducible production dependencies.
- Do not allow critical security scans to fail without an explicit compensating gate.
Frequently Asked Questions
Does this skill generate complete GitLab CI files?
It can draft complete configurations, but each pipeline still requires repository-specific values and validation.
Can it configure GitLab Runners?
It can recommend runner requirements, but it does not install, register, or validate runners.
Does it support Kubernetes deployments?
Yes. It provides staging and production job patterns that require secure cluster credentials and verified TLS.
Can it create Terraform workflows?
Yes. It covers validation, planning, plan artifacts, manual apply jobs, and main-branch controls.
Are the examples ready for production?
No. Review image pins, secret handling, scan policies, permissions, network access, and environment protections first.
Are referenced template files included?
No. The audited package contains only SKILL.md, so referenced assets, references, and playbook files are unavailable.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/gitlab-ci-patternsRef
88a8e9a07f4c54ab105c1c41b6267c287146b07b
Maintenance freshness
7/26/2026
Usage
9 downloads · 113 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-fullstack
82Build Fullstack Apps with Senior Patterns
Teams need consistent setup, architecture, and review guidance for modern web applications. This skill provides scaffolders, workflow references, and quality prompts for React, Next.js, Node.js, GraphQL, and PostgreSQL projects.
Coding & Development View
📦
senior-architect
81Design Scalable Software Architectures
Architecture decisions are hard to compare across web, mobile, backend, and cloud systems. This skill provides structured guides and local scaffold scripts for reports, dependency review, and trade-off documentation.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
infrastructure
78Deploy Guts Node Infrastructure
by AbdelStark
Deploying Guts nodes requires consistent Terraform, Docker, and Kubernetes patterns. This skill provides reusable infrastructure examples for local, test, and production environments.
DevOps & Infrastructure View
📦
deployment-automation
77Automate Cloud Deployment Workflows
by supercent-io
Manual releases are slow and error prone. This skill helps create CI/CD, container, and rollout templates for repeatable deployments.
DevOps & Infrastructure View
📦
senior-devops
81Automate DevOps Pipelines and Deployments
by alirezarezvani
DevOps work often requires repeatable pipeline, infrastructure, and deployment patterns. This skill provides scripts and reference guides for CI/CD, IaC, deployment, and operations review.
DevOps & Infrastructure View
📦
cloud-infrastructure
81Design Cloud Infrastructure
by 89jobrien
Cloud teams need consistent patterns for secure, resilient, and cost-aware infrastructure. This skill guides architecture choices, Terraform organization, availability planning, and operational controls.
DevOps & Infrastructure View
📦
helm-chart-architect
80Design Production Helm Chart Architecture
by 92Bilal26
Teams often copy Helm examples that do not match their operational constraints. This skill guides chart architecture through dependencies, hooks, values, environments, and operator needs.
DevOps & Infrastructure View
📦
devops-orchestrator
79Coordinate DevOps Delivery
by Brownbull
DevOps work often spans pipelines, infrastructure, monitoring, and deployment decisions. This skill organizes those tasks into checklists, handoffs, and rollout plans.
DevOps & Infrastructure View