Loading...
Loading...
Found 155 Skills
Set up and run Git-backed schema sync between a repository and Prepr CMS environments, with schema files in prepr/schema/. Use this skill whenever the user wants to sync a Prepr schema via GitHub, GitLab, Bitbucket or Azure DevOps, get local schema file changes into a Prepr environment, export an environment's schema to the repository, promote schema between development, acceptance and production, add schema validation to CI, debug a schema import that fails or returns github.validation.failed, check whether the schema files and an environment have drifted, or asks why schema file edits have not appeared in Prepr. Also use it when the user considers direct environment-to-environment sync.
Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persistence via modified workflow definitions. Each technique section provides working exploitation code, detection indicators, and defensive countermeasures.
Comprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for using recovered secrets to expand access.
Vercel deployment and CI/CD expert guidance. Use when deploying, promoting, rolling back, inspecting deployments, building with --prebuilt, or configuring CI workflow files for Vercel.
CI/CD Pipeline Builder
Automate GitHub/GitLab release workflows. Use cases: release new versions, create version tags, update CHANGELOG. Automatically analyze Git commits, update CHANGELOG.md, determine semantic version numbers, create Git tags, push to remote and create Release
List my open MRs/PRs in the current repo/worktree, each with its tracker ticket. Use when I invoke /list-open-work, or ask what I have open, what's in review, or for a standup list of my open MRs or PRs.
Configure CI/CD pipelines for Documenso integrations. Use when setting up automated testing, deployment pipelines, or continuous integration for Documenso projects. Trigger with phrases like "documenso CI", "documenso GitHub Actions", "documenso pipeline", "documenso automated testing".
CI/CD 流水线配置
Babysit a pull request through its bot review rounds: verify, fix, reply, resolve. Use for any babysit or watch-the-PR ask.
Push bonbon-ai outer repo as full snapshot, including be/ and fe/ content