Skills gitops-workflow

📦

gitops-workflow

Name: gitops-workflow
Author: wshobson

Content revision r1 Safe 🌐 Network access⚙️ External commands

Implement Kubernetes GitOps Workflows

Kubernetes delivery is hard to keep consistent across teams and clusters. This skill helps Claude, Codex, and Claude Code design GitOps workflows with ArgoCD, Flux, sync policies, and safe deployment patterns.

Supports: Claude Codex Code(CC)

📊 74 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "gitops-workflow" from https://skillstore.io/skills/wshobson-gitops-workflow.md and its manifest at https://skillstore.io/api/skills/wshobson-gitops-workflow/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/wshobson-gitops-workflow.md Signed manifest GET /api/skills/wshobson-gitops-workflow/manifest Signed lockfile GET /api/skills/wshobson-gitops-workflow/lockfile

Test it

Using "gitops-workflow". Help me set up ArgoCD for a production namespace.

Expected outcome:

A step-by-step plan covering namespace creation, ArgoCD installation, repository layout, application manifest fields, automated sync settings, and safety checks before production use.

Using "gitops-workflow". We need Flux to deploy one app from GitHub.

Expected outcome:

A Flux workflow that covers bootstrap planning, GitRepository configuration, Kustomization settings, reconciliation intervals, and review points for credentials and branch selection.

Using "gitops-workflow". Our GitOps sync keeps failing after manual changes.

Expected outcome:

A troubleshooting checklist for sync status, diffs, prune behavior, self-heal settings, forced sync risks, and alerts for recurring drift.

Security Audit

Safe

v9 • 7/9/2026 Open versioned report

Most static findings are Markdown examples, YAML manifests, or expected public URLs. The main risk is the Flux installer that pipes network-fetched shell code into sudo. Some kubectl, argocd, flux, and kubeseal examples can change clusters or expose secrets.

Files scanned

553

Lines analyzed

Review items

False positives ignored

Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:118-129

Ruby/shell backtick execution

```bash

This fenced bash block includes a remote installer piped to sudo bash and Flux bootstrap commands that modify infrastructure. Although documented for Flux setup, it asks users or agents to execute privileged network-sourced shell code.

High

SKILL.md:120

sudo privilege escalation

curl -s https://fluxcd.io/install.sh | sudo bash

The line explicitly pipes a remote installer from fluxcd.io into sudo bash. Running network-fetched shell code with elevated privileges is a real supply-chain and privilege-escalation risk.

Medium

SKILL.md:34-43

Ruby/shell backtick execution

```bash

This fenced bash block instructs users to run kubectl commands that create a namespace, apply a remote manifest, and read an initial admin secret. It is legitimate GitOps guidance, but it can change a cluster and expose credentials if copied without review.

Medium

SKILL.md:248-253

Ruby/shell backtick execution

```bash

This fenced bash block demonstrates kubeseal shell redirection that reads and writes Kubernetes secret files. It is normal GitOps guidance, but mishandling the input secret file can expose sensitive material.

Medium

SKILL.md:271-274

Ruby/shell backtick execution

```bash

This fenced bash block includes argocd app sync with prune, which can alter or delete cluster resources not present in Git. It is legitimate troubleshooting guidance but has real operational impact.

Medium

SKILL.md:277-280

Ruby/shell backtick execution

```bash

This fenced bash block includes argocd app sync with force, which can override drift and change live resources. It is valid troubleshooting guidance but risky on production clusters.

Medium

SKILL.md:120

Hardcoded URL

curl -s https://fluxcd.io/install.sh | sudo bash

The URL is used in a curl pipeline that immediately executes remote content with sudo. The network target is not hidden, but this pattern carries supply-chain risk if copied directly.

Risk Factors

🌐 Network access (14)

references/argocd-setup.md:8 references/argocd-setup.md:13 references/argocd-setup.md:18 references/argocd-setup.md:72 references/argocd-setup.md:78 references/argocd-setup.md:80 references/argocd-setup.md:94 SKILL.md:39 SKILL.md:79 SKILL.md:83 SKILL.md:104 SKILL.md:108 SKILL.md:120 SKILL.md:141

⚙️ External commands (34)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/wshobson-gitops-workflow/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/wshobson-gitops-workflow/security.svg)](https://skillstore.io/skills/wshobson-gitops-workflow?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/wshobson-gitops-workflow?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wshobson-gitops-workflow/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/wshobson-gitops-workflow.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

wshobson. (2026). gitops-workflow security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wshobson-gitops-workflow/audits/9

BibTeX citation

@techreport{wshobson-wshobson-gitops-workflow-2026,
  author = {wshobson},
  title = {gitops-workflow security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/wshobson-gitops-workflow/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gitops-workflow security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "wshobson"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/wshobson-gitops-workflow/audits/9"
identifiers:
  - type: other
    value: "skillstore:wshobson-gitops-workflow:audit:9"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

wshobson Recommended Current

wshobson-gitops-workflow

Skillstore Score 74

Evidence Confidence High

Skillstore usage 11

Updated

2026-08-21

sickn33

sickn33-gitops-workflow

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Plan a New GitOps Rollout

Create a repository layout and deployment flow for a Kubernetes application managed from Git.

Standardize ArgoCD or Flux Setup

Compare setup steps and resource definitions before adopting ArgoCD or Flux for continuous delivery.

Improve Deployment Safety

Add sync policies, progressive delivery, approval gates, and secret management patterns to existing workflows.

Try These Prompts

Explain GitOps Basics

Use the gitops-workflow skill to explain the main GitOps principles for my Kubernetes team. Include how Git, ArgoCD, and Flux fit together.

Design Repository Structure

Use the gitops-workflow skill to propose a GitOps repository structure for staging and production. Include app folders, infrastructure folders, and ArgoCD application placement.

Compare ArgoCD and Flux

Use the gitops-workflow skill to compare ArgoCD and Flux for our Kubernetes deployment workflow. Focus on setup, sync behavior, secret handling, and operational risks.

Review Production Workflow

Use the gitops-workflow skill to review our production GitOps design. Check sync policies, pruning behavior, rollback flow, progressive delivery, RBAC, SSO, and secret management.

Best Practices

Review cluster context, namespace, and repository target before running any generated command.
Use staging, approval gates, and progressive delivery before enabling automated production sync.
Keep plaintext secrets out of Git and document the approved secret management path.

Avoid

Do not run remote installer pipelines with elevated privileges without verification.
Do not enable automated prune in production before teams understand deletion impact.
Do not store Kubernetes secrets or long-lived repository tokens directly in Git.