Tessl • The package manager for agent skills

building-devsecops-pipeline-with-gitlab-ci

Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security templates. Use when building a shift-left DevSecOps pipeline in GitLab, adding automated vulnerability scanning stages to .gitlab-ci.yml, or triaging scanner findings with GitLab Duo AI before deployment.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/building-devsecops-pipeline-with-gitlab-ci/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with a complete, executable pipeline, but it underuses the provided bundle (no links to references/scripts/assets) and lacks explicit validation feedback loops for the destructive deploy step.

Suggestions

Add one-level-deep links to the existing bundle (e.g. 'See references/workflows.md for MR security review flow', 'See references/api-reference.md for template catalog', 'See assets/template.md for a scanner checklist') so detail moves out of SKILL.md.

Add an explicit verification gate before deploy-production, e.g. require zero Critical SAST/dependency findings and a passing DAST scan, with a 'fix and re-scan' feedback loop, to lift workflow clarity above the destructive-operation cap.

Trim the generic 'When to Use' bullets and the Overview's restatement of what GitLab's DevSecOps platform is, keeping only trigger-relevant guidance.

Dimension	Reasoning	Score
Conciseness	Mostly efficient scanning-stage sections and concrete YAML, but the Overview re-explains GitLab's DevSecOps platform and the 'When to Use' bullets are generic template boilerplate ('When deploying or configuring building devsecops pipeline with gitlab ci capabilities in your environment') that could be trimmed.	3 / 5
Actionability	Provides a complete, copy-paste-ready .gitlab-ci.yml with template includes and stage overrides, a concrete .gitlab/sast-ruleset.toml, and step-by-step policy configuration — covering the common pipeline cases executable as written.	5 / 5
Workflow Clarity	Pipeline stages are clearly sequenced (build→test→security→deploy-staging→dast→deploy-production), but production deployment is a destructive/batch operation and the body describes no explicit validate→fix→retry checkpoint or verification gate, so workflow clarity is capped at 3.	3 / 5
Progressive Disclosure	Bundle files exist (references/api-reference.md, standards.md, workflows.md; scripts/agent.py, process.py; assets/template.md) but the body never references them — only external GitLab docs URLs — while the full pipeline YAML and reference tables are inlined rather than split out.	2 / 5
	Total	13 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, concrete description that clearly states the capability and gives explicit, natural trigger phrases. Minor room to broaden trigger synonyms, but it robustly answers both 'what' and 'when'.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — embedding SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via managed templates — with comprehensive coverage of the pipeline's scanning capabilities.	5 / 5
Completeness	Explicitly answers both what (configure a pipeline embedding the listed scanners via managed templates) and when ('Use when building a shift-left DevSecOps pipeline... adding automated vulnerability scanning stages... or triaging scanner findings with GitLab Duo AI before deployment').	5 / 5
Trigger Term Quality	Strong natural keywords ('shift-left DevSecOps pipeline in GitLab', '.gitlab-ci.yml', 'scanner findings', 'GitLab Duo AI') that users would say, but a few natural synonyms (e.g. 'CI security', 'security scanning') are missing.	4 / 5
Distinctiveness Conflict Risk	Clear niche anchored to GitLab's managed security templates and Duo AI finding triage; triggers are specific enough to avoid overlap with generic security or CI skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/building-devsecops-pipeline-with-gitlab-ci/SKILL.md
Commit: 54a7988

Reviewed: ~1 hour ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.