Skills gitops-workflow

📦

gitops-workflow

Name: gitops-workflow
Author: sickn33

Content revision r2 High Risk 🌐 Network access⚙️ External commands📁 Filesystem access

Build Secure GitOps Workflows with Argo CD and Flux

Kubernetes delivery becomes risky when cluster state and deployment changes lack a controlled source of truth. This skill provides practical Argo CD and Flux workflow guidance.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "gitops-workflow" from https://skillstore.io/skills/sickn33-gitops-workflow.md and its manifest at https://skillstore.io/api/skills/sickn33-gitops-workflow/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-gitops-workflow.md Signed manifest GET /api/skills/sickn33-gitops-workflow/manifest Signed lockfile GET /api/skills/sickn33-gitops-workflow/lockfile

Test it

Using "gitops-workflow". Plan Argo CD adoption for a staging cluster and one application.

Expected outcome:

The plan separates controller installation, repository onboarding, staging synchronization, health validation, and rollback testing. Production automation remains disabled.

Using "gitops-workflow". Recommend safe synchronization behavior for production.

Expected outcome:

Require approval before synchronization.
Disable automatic pruning until recovery tests pass.
Define maintenance windows and retry limits.
Alert on drift, failed health checks, and reconciliation errors.

Using "gitops-workflow". Compare Argo CD and Flux for a platform team.

Expected outcome:

The comparison covers operating model, repository integration, reconciliation resources, access controls, multi-cluster patterns, and team maintenance requirements.

Security Audit

High Risk

v6 • 7/24/2026 Open versioned report

Most static command-execution alerts are false positives caused by Markdown fences, placeholder URLs, or benign temporary-directory handling. Confirmed risks include unpinned remote Kubernetes manifests and a downloaded Flux installer executed with sudo without integrity verification. The examples also expose credentials through terminal commands and enable automated pruning against a production path.

Files scanned

586

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:100-111

Production auto-sync enables destructive pruning

The example targets apps/production/my-app while enabling automated pruning and self-healing. Applying it unchanged can delete resources or bypass production approval controls.

The production path, automated synchronization, prune, and selfHeal settings appear together in one manifest and directly conflict with the safety guidance on line 41.

Medium

SKILL.md:62-63 references/argocd-setup.md:29-30 references/argocd-setup.md:72

Setup commands handle credentials unsafely

Examples print the initial admin password and pass a repository token as a CLI argument. Secrets can enter terminal logs, process listings, or shell history.

The commands explicitly decode or print an administrative password and place a token in a command argument. These are established credential exposure paths.

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:148

sudo privilege escalation

sudo bash "$tmpdir/flux-install.sh"

The command executes a network-downloaded script as root without a checksum or signature check. Displaying the script first does not provide reliable integrity verification.

Medium

references/argocd-setup.md:8

Hardcoded URL

kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/insta

The command downloads a manifest from the mutable Argo CD stable branch and applies it directly to the cluster. It provides no release pin or integrity verification.

Medium

references/argocd-setup.md:13

Hardcoded URL

kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/ha/in

The high-availability manifest is fetched from a mutable stable branch and applied directly to the cluster. A compromised or changed upstream file would receive cluster permissions.

Medium

SKILL.md:60

Hardcoded URL

kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/insta

The example directly applies a Kubernetes manifest fetched from a mutable stable branch. It does not pin reviewed content or verify its integrity.

Medium

SKILL.md:146

Hardcoded URL

curl -fsSLo "$tmpdir/flux-install.sh" https://fluxcd.io/install.sh

The command downloads an executable installer from a mutable URL without a checksum or signature. The following example runs the downloaded content as root.

Risk Factors

🌐 Network access (14)

references/argocd-setup.md:8 references/argocd-setup.md:13 references/argocd-setup.md:18 references/argocd-setup.md:72 references/argocd-setup.md:78 references/argocd-setup.md:80 references/argocd-setup.md:94 SKILL.md:60 SKILL.md:100 SKILL.md:104 SKILL.md:125 SKILL.md:129 SKILL.md:146 SKILL.md:169

⚙️ External commands (37)

📁 Filesystem access (1)

SKILL.md:144

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-gitops-workflow/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-gitops-workflow/security.svg)](https://skillstore.io/skills/sickn33-gitops-workflow?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-gitops-workflow?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-gitops-workflow/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-gitops-workflow.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). gitops-workflow security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-gitops-workflow/audits/6

BibTeX citation

@techreport{sickn33-sickn33-gitops-workflow-2026,
  author = {sickn33},
  title = {gitops-workflow security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/sickn33-gitops-workflow/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gitops-workflow security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-24"
url: "https://skillstore.io/skills/sickn33-gitops-workflow/audits/6"
identifiers:
  - type: other
    value: "skillstore:sickn33-gitops-workflow:audit:6"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

wshobson Recommended

wshobson-gitops-workflow

Skillstore Score 74

Evidence Confidence High

Skillstore usage 11

Updated

2026-08-21

sickn33 Current

sickn33-gitops-workflow

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Establish a cluster delivery platform

Design repository structure, controller setup, synchronization policies, and production approval boundaries.

Onboard an application to GitOps

Define application sources, deployment destinations, secret references, and staged promotion behavior.

Review deployment controls

Assess pruning, self-healing, retries, health checks, and operational safeguards before rollout.

Try These Prompts

Plan a basic GitOps setup

Create a beginner GitOps plan for my Kubernetes cluster using [Argo CD or Flux]. List prerequisites, safe installation choices, and validation steps.

Design a repository layout

Design a GitOps repository for [applications], [environments], and [infrastructure]. Explain ownership, promotion flow, and where controller resources belong.

Configure application reconciliation

Draft an Argo CD or Flux reconciliation design for [application]. Include sync intervals, retries, health checks, pruning safeguards, and secret references.

Architect controlled multi-cluster delivery

Design a multi-cluster GitOps workflow for [environments]. Include progressive delivery, approval gates, rollback, RBAC, observability, and supply-chain integrity requirements.

Best Practices

Pin installation artifacts and verify checksums or signatures before applying them.
Test synchronization, pruning, rollback, and secret handling in staging before production.
Require least-privilege access, production approvals, health checks, and reconciliation alerts.

Avoid

Do not apply mutable remote manifests directly to a production cluster.
Do not store plaintext credentials in Git, command arguments, or shared terminal logs.
Do not enable automatic production pruning without tested recovery and explicit approval controls.

Frequently Asked Questions

Does this skill deploy resources automatically?

No. It provides guidance and examples, but deployment requires your tools, credentials, permissions, and explicit execution.

Which GitOps controllers are covered?

The skill covers Argo CD and Flux installation, application sources, reconciliation, synchronization policies, and troubleshooting.

Can I use the examples unchanged?

No. Replace placeholders and review namespaces, repositories, permissions, versions, policies, and controller compatibility.

How should production synchronization be protected?

Use approval gates, maintenance windows, least privilege, tested rollback, health checks, alerts, and cautious pruning settings.

How are secrets handled?

The guidance favors External Secrets or sealed secrets. Keep plaintext values outside Git, shell history, logs, and command arguments.

Does the skill support multi-cluster delivery?

It describes repository and controller patterns that can support multiple clusters. Each environment still requires tailored access and policy design.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/gitops-workflow

Ref

88a8e9a07f4c54ab105c1c41b6267c287146b07b

Maintenance freshness

7/26/2026

Usage

10 downloads · 132 views

File structure

📁 references/

📄 argocd-setup.md

📄 sync-policies.md

📄 SKILL.md

More from sickn33

View all

📦

content-creator

Create Brand-Consistent Marketing Content

Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.

Writing & Content View

📦

prompt-engineering-patterns

Improve LLM Prompts With Proven Patterns

Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.

Productivity View

📦

senior-fullstack

Build Fullstack Apps with Senior Patterns

Teams need consistent setup, architecture, and review guidance for modern web applications. This skill provides scaffolders, workflow references, and quality prompts for React, Next.js, Node.js, GraphQL, and PostgreSQL projects.

Coding & Development View

📦

senior-architect

Design Scalable Software Architectures

Architecture decisions are hard to compare across web, mobile, backend, and cloud systems. This skill provides structured guides and local scaffold scripts for reports, dependency review, and trade-off documentation.

Coding & Development View

📦

prompt-engineer

Optimize AI Prompts With Prompt Engineer

Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.

Productivity View

📦

product-manager-toolkit

Prioritize Product Work With Research Insights

Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.

Productivity View

View all

📦

DevOps & Deployment

Build Safer Deployment Workflows

by ArieGoldkin

Deployment teams need consistent patterns for CI/CD, containers, Kubernetes, and cloud infrastructure. This skill provides templates and review guidance for planning these workflows safely.

DevOps & Infrastructure View

📦

helm-chart-architect

Design Production Helm Chart Architecture

by 92Bilal26

Teams often copy Helm examples that do not match their operational constraints. This skill guides chart architecture through dependencies, hooks, values, environments, and operator needs.

DevOps & Infrastructure View

📦

deployment-pipeline-design

Design Safer CI/CD Deployment Pipelines

by wshobson

Teams often ship through pipelines that lack clear gates, rollback plans, or production checks. This skill guides Claude, Codex, and Claude Code to design staged deployment workflows with approvals, strategies, and verification.

DevOps & Infrastructure View

📦

istio-traffic-management

Manage Istio Traffic Policies

by wshobson

Service mesh routing can be difficult to configure safely across many services. This skill provides Istio templates and guidance for routing, canary releases, retries, load balancing, gateways, and resilience controls.

DevOps & Infrastructure View

📦

infrastructure

Deploy Guts Node Infrastructure

by AbdelStark

Deploying Guts nodes requires consistent Terraform, Docker, and Kubernetes patterns. This skill provides reusable infrastructure examples for local, test, and production environments.

DevOps & Infrastructure View

📦

prometheus-configuration

Configure Prometheus Monitoring

by wshobson

Teams need reliable metrics without fragile manual configuration. This skill guides Prometheus setup, scrape jobs, recording rules, alerts, and validation steps.

DevOps & Infrastructure View

gitops-workflow

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (2)

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Compare variants

Skillstore Score

What You Can Build

Establish a cluster delivery platform

Onboard an application to GitOps

Review deployment controls

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details

More from sickn33

content-creator

prompt-engineering-patterns

senior-fullstack

senior-architect

prompt-engineer

product-manager-toolkit

Related Skills

DevOps & Deployment

helm-chart-architect

deployment-pipeline-design

istio-traffic-management

infrastructure

prometheus-configuration