endor-cicd
Generate CI/CD pipeline configurations for Endor Labs security scanning. Supports GitHub Actions, GitLab CI, Jenkins, Azure DevOps, Bitbucket Pipelines, and CircleCI. Use when the user says "add security to my pipeline", "endor CI/CD", "GitHub Actions endor", "set up CI scanning", or wants automated security checks in their build pipeline. Do NOT use for running scans locally (/endor-scan) or managing policies (/endor-policy).
89
86%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Advisory
Suggest reviewing before use
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that hits all the marks. It provides specific capabilities across six named CI/CD platforms, includes natural trigger terms users would actually say, explicitly defines both when to use and when NOT to use the skill, and carves out a distinct niche by excluding related Endor Labs skills. The negative boundary conditions ('Do NOT use for...') are a particularly strong feature for disambiguation.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: generating CI/CD pipeline configurations, supporting six named CI/CD platforms (GitHub Actions, GitLab CI, Jenkins, Azure DevOps, Bitbucket Pipelines, CircleCI), and specifies the domain of Endor Labs security scanning. | 3 / 3 |
Completeness | Clearly answers both 'what' (generate CI/CD pipeline configurations for Endor Labs security scanning across six platforms) and 'when' (explicit 'Use when...' clause with trigger phrases), plus includes explicit 'Do NOT use' exclusions for disambiguation. | 3 / 3 |
Trigger Term Quality | Includes highly natural trigger terms users would say: 'add security to my pipeline', 'endor CI/CD', 'GitHub Actions endor', 'set up CI scanning', 'automated security checks', 'build pipeline'. These cover multiple natural phrasings and variations. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive with a clear niche (Endor Labs CI/CD pipeline configs), names specific platforms, and explicitly excludes related but different skills (/endor-scan for local scans, /endor-policy for policy management), minimizing conflict risk. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
72%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a well-organized, concise skill that effectively structures a multi-platform CI/CD generation workflow with good progressive disclosure. Its main weaknesses are the lack of concrete inline examples (even a single GitHub Actions snippet would help) and missing validation/feedback loops after configuration generation. The workflow steps are clear in sequence but could benefit from explicit verification checkpoints.
Suggestions
Add at least one inline code example (e.g., a minimal GitHub Actions snippet) so the skill has concrete, actionable guidance without requiring the reference file for basic understanding.
Add a validation checkpoint after Step 3, such as 'Verify the generated YAML is valid syntax' and a feedback loop: 'If the first pipeline run fails, check logs for missing secrets or build command errors and regenerate.'
Make Step 1 detection more concrete by listing specific file paths to check (e.g., `.github/workflows/*.yml`, `.gitlab-ci.yml`, `Jenkinsfile`) rather than the abstract 'check for existing CI/CD config files'.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The content is lean and efficient. It avoids explaining what CI/CD is or how platforms work, assumes Claude's competence, and every section serves a clear purpose. The table format is an efficient way to present platform mappings and secrets. | 3 / 3 |
Actionability | The workflow provides clear steps but lacks executable code examples — no actual template snippets are shown inline, and the real templates are deferred to `references/cicd-templates.md`. The detection steps describe what to do conceptually ('check for existing CI/CD config files') rather than providing specific file paths to check or concrete commands. | 2 / 3 |
Workflow Clarity | The four-step workflow is clearly sequenced and the error handling table is helpful. However, there are no validation checkpoints — after generating and committing the config, there's no explicit step to verify the pipeline runs successfully or a feedback loop for fixing generation errors. Step 3 says 'push test commit to verify' but doesn't describe what to check or how to handle failures. | 2 / 3 |
Progressive Disclosure | The skill is well-structured as an overview with clear one-level-deep references to `references/cicd-templates.md` and `references/data-sources.md`. Content is appropriately split between the overview and reference files, and navigation is clearly signaled. | 3 / 3 |
Total | 10 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- endorlabs/skills-ideas
- Commit
344e7ff
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.