StarSling Skills
Four skills for GitHub Actions: CI speedup, configuration scoring, workflow attack scanning and StarSling account reports.
- 107 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The skills read workflows and run history and, on request, edit CI configuration files.
- `sling` stores an account credential at `~/.config/sling/credentials`.
Install
- Works in
Manual install
npx skills add starslingdev/skillsChoose skills and agent in the prompt. One skill: add --skill ci-secure, for every project: the -g flag.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The skills read workflows and run history and, on request, edit CI configuration files.
- `sling` stores an account credential at `~/.config/sling/credentials`.
This is third-party code. Review the repository files before installing.
What it does
A set of four skills for GitHub Actions. `ci-speedup` looks for what slows CI and wastes runner minutes using 90+ optimization patterns, local workflows and GitHub run history. `ci-score` grades configuration on 10+ checks: caching, shallow checkout, sharding, concurrency cancellation, path filters, timeouts, action pinning and OIDC scoping. It runs fully offline. `ci-secure` looks for 10+ critical CI attack vectors: template injection, privileged fork code, cache poisoning, impostor action SHAs, secret dumps and `$GITHUB_ENV` hijacking. Each finding names the file and line and explains what an attacker could do. The first three skills produce a report and offer to fix the findings you select or save the report as Markdown. The fourth, `sling`, shows usage, performance, billing and runs of a StarSling account.
Who it is for. Developers and platform engineers maintaining GitHub Actions who want faster builds and closed attack paths in workflows.
Good fit when
- A build is slow and you need to see which steps eat runner minutes.
- Before a release the CI setup should be graded against a checklist of practices.
- A workflow runs on events from external forks and needs an attack check.
- You need a summary of costs and run failures in a StarSling account.
Not a fit when
- You need a comprehensive security audit: `ci-secure` is deliberately limited to a set of real attack chains.
- Builds do not run on GitHub Actions: the skills read its workflows.
- `sling` is useless without a StarSling account and the installed GitHub App.
Example request
Why is my CI so slow? Show the report and propose fixes without committing anything.Limitations
`ci-speedup` and `ci-score` need Python 3.9 and PyYAML, and `ci-speedup` also needs an authenticated `gh` since it reads run history through the GitHub API. For `ci-secure` `gh` is optional and adds four extra checks. `sling` queries the account through StarSling's control plane, sends organization, repository and run identifiers and stores its credential at `~/.config/sling/credentials`. The audit skills do not send repository contents to StarSling and fixes stay in the working tree without a commit, push or pull request until you ask. The `ci-score` score measures practice adherence, not speed, and is not a security audit.
How to disable. Delete the skill folders from the agent's directory or reinstall without the ones you do not need. For `sling` delete `~/.config/sling/credentials` and revoke the GitHub App.
FAQ
How do I install one skill?
Add a flag: `npx skills add starslingdev/skills --skill ci-secure`. The `-g` flag installs for every project.
How do I call a skill?
With `/ci-speedup` (`$ci-speedup` in Codex) or a plain question like "Why is my CI slow?".
Does repository data leave the machine?
Not for `ci-score` and `ci-secure`: they run locally. `ci-speedup` reads run history through `gh` and `sling` queries a StarSling account.
What does zero findings in ci-secure mean?
It is a first-class result. A check that could not run is reported as did not run, never as a pass.
Can ci-secure run on every pull request?
Yes, the agent installs the check in advisory mode: when ready, remove `--advisory` and make the check required.
Discussion
No questions or reviews yet.
Related
SkillsA skill and plugin for Git and GitHub: branches, Conventional Commits and a pull request path to a green merge.
A gh extension for agentic workflows: describe a task in Markdown and run it with an agent in GitHub Actions
KubeShark skill: the agent finds the failure mode first, then writes manifests, Helm and Kustomize to official practice with a rollback plan
A skill set for website performance and scalability, currently holding ooda-loop: observe, orient, decide, act.
A controller for self-hosted GitHub Actions runners with three skills and MCP: an agent debugs failed jobs and audits workflows
A collection of Copilot skills and agents for Azure, API Management, Terraform and diagrams, installed via the skills CLI or APM
README in short
Tables show purpose, requirements and data handling for each skill, followed by sections with install commands, sample reports and links to methodology.
README badge
Original SKILL.md
---
name: ci-secure
description: >-
Scans a repo's GitHub Actions workflows for the ten critical CI/CD
attack vectors — template injection, fork code executed with privileges
(pwn requests), cache poisoning, impostor action SHAs, secrets dumps,
GITHUB_ENV hijack, write-token untrusted triggers, credentials in
caches/artifacts, unverified remote code execution (curl|bash and
mutable fetch-and-run), and dependency install scripts
running in a job that holds secrets — reports every finding
with a plain-English attacker scenario, plus pass/fail config
hygiene checks, and fixes selected findings via per-finding
subagents. Deliberately NOT comprehensive — critical
exploit-chain checks only (references/why-these-ten.md).
Use when: the user asks to audit or review CI/CD or GitHub Actions
security posture, "is my CI secure", "audit my CI security", or names
ci-secure / /ci-secure. Do NOT trigger for: CI speed, cost, or
wall-clock audits ("why is CI slow") — use ci-speedup; CI config
best-practices grading ("grade my CI", "CI score") — use ci-score.
license: MIT
---
# CI Secure
Scans `.github/workflows/*.yml` against the **ten critical attack vectors**
in [references/security-patterns.md](references/security-patterns.md) — each
a complete outsider → compromise path with real incidents behind it (the
selection criterion and rejection record:
[references/why-these-ten.md](references/why-these-ten.md)). Every finding
renders with a "what an attacker could do" scenario; **zero findings is a
first-class result**. The skill asks which findings to fix and dispatches one
subagent per finding group. It never commits, pushes, or opens a PR
**unasked** — by default the user reviews the working-tree diff themselves.
**Scope honesty (verbatim, in every report):** *Critical exploit-chain checks
only — this is not a comprehensive audit.*
**Prereqs:** PyYAML (`pip install pyyaml` — the scanner's only third-party
dep). `gh` is optional, used for the network-gated impostor-SHA check (P14.11
— the one vector that cannot be answered from YAML alone), the dormancy note,
and six config facts read over the API (required checks skippable, fork-PR
approval, CODEOWNERS enforced, two environment checks, secrets). Everything