cicd-posture
Skill from endorlabs/ai-plugins
Install
npx skills add endorlabs/ai-plugins --skill cicd-posture
Runs the open skills CLI and installs the skill for your agent (Claude Code, Codex, Cursor …). Alternatively copy the skill folder into .claude/skills/ or upload it in Claude.ai under Settings → Skills.
What does the cicd-posture skill do?
Description from the SKILL.md in the source repository.
Questions about cicd-posture
What does the cicd-posture skill do?
Assesses CI/CD and software supply-chain security across an Endor namespace, GitHub organization, selected repositories, or the current repository. It combines existing Endor SCPM, CI/CD, GitHub Actions, and supply-chain findings with read-only repository configuration evidence and optional local CI inspection to produce deterministic scores, critical overrides, prioritized improvements, and explicit data gaps. It does not modify Endor, GitHub, or repository state.
How do I install cicd-posture?
In a terminal: npx skills add endorlabs/ai-plugins --skill cicd-posture. The skills CLI asks which agents to install it for. In Claude.ai you can upload the skill folder as a ZIP under Settings → Skills.
Which agents can use cicd-posture?
Skills use the open SKILL.md format, which Claude Code, Claude.ai, the Claude API, OpenAI Codex, Cursor, Gemini CLI and other agents support.
Is cicd-posture safe to use?
Our automatic check found no risky patterns (piped shell scripts, hidden characters, secret access, prompt overrides). It is not a full audit – read the SKILL.md and any scripts before installing.
More skills from endorlabs/ai-plugins
Triages Endor AI SAST findings using exploit-reproduction evidence, data-flow context, and remediation guidance to distinguish actionable vulnerabilities from noise.
Compares GitHub repository inventory with Endor projects, GitHub App coverage, monitored branches, scan profiles, package-manager integrations, dependency resolution, and reachability evidence.
Evaluates an exact package version, summarizes package risk, or reviews dependencies declared by a repository through one focused workflow.
Use when setting up Endor Labs Agent Kit for Claude Code, checking readiness, verifying Endor auth, choosing namespaces, or diagnosing missing endorctl, gh, Endor MCP, or workflow prerequisites.
Browses, filters, and summarizes existing Endor findings without starting new scans or performing remediation. It shows the applied scope and filters, relevant severity and reachability context, pagination or truncation limits, and any …
Correlates current software supply-chain malware intelligence for affected packages and versions with Endor inventory across a namespace and its child namespaces.
Evaluates candidate dependency upgrades using Endor VersionUpgrade data, Code Impact Analysis, findings, breaking-change information, and Endor-provided manifest targets.
Previews safe remediation options for existing Endor findings without changing code or opening a pull request. It compares VersionUpgrade and Upgrade Impact Analysis candidates using findings fixed, upgrade risk, compatibility evidence, and …
Related skills in DevOps & Cloud
The HyperFrames CLI by job - scaffold, check, look at frames, edit the timeline, preview, render locally or in the cloud, publish, project history - plus reading its JSON and recovering from …
Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end. USE FOR: foundry, azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy/troubleshoot, prompt agent, managed harness agent …
Debug Azure production issues using AppLens, Azure Monitor, resource health, and safe triage, including evidence-only diagnosis without live access.
Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow.
Build and troubleshoot Azure AI Search, Speech, OpenAI, and Document Intelligence apps. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, Speech SDK logs, session ID, result …
Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead.
Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying.
List, find, and show Azure resources across subscriptions or resource groups. Handles prompts like "list the websites in my subscription", "list my web apps", "show my app services", "list virtual machines", "list …