agentmods.dev

gitlab-ci-validator

gitlab-ci-validator is a skill for Claude Code from akin-ozer/cc-devops-skills. It costs 25 tokens per session (1,528 once invoked), scanned A, original, Apache-2.0.

A checker for GitLab CI/CD configuration in `.gitlab-ci.yml`, the file that defines a GitLab pipeline's stages and jobs. It can inspect syntax, configuration structure, recommended practices, and security concerns.

In plain words
What is it for?
Use it to validate a GitLab pipeline, troubleshoot failures, review security, check best practices, and lint configuration before merging.
Why use it?
It helps explain why a pipeline fails and identifies risky or problematic configuration before a merge. It supports separate syntax, schema, testing, and broader review checks.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the devops-skills-plugin plugin — 31 skills shipped together

not rated 332repo +2 3mo ago A scan Socket: passSnyk: passSkillSpector: pass 25 tokens original Apache-2.0

Good fit Use it to validate a GitLab pipeline, troubleshoot failures, review security, check best practices, and lint configuration before merging.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/akin-ozer/cc-devops-skills/gitlab-ci-validator
View source ↗ akin-ozer/cc-devops-skills
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add akin-ozer/cc-devops-skills --skill gitlab-ci-validator
Clone the repo
git clone --depth 1 https://github.com/akin-ozer/cc-devops-skills

Made for: Claude Code.

Or install devops-skills-plugin, the plugin that ships this one along with the rest of its 31 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for gitlab-ci-validator

README.md
[![agentmods](https://agentmods.dev/badge/skills/akin-ozer/cc-devops-skills/gitlab-ci-validator/github.svg)](https://agentmods.dev/skills/akin-ozer/cc-devops-skills/gitlab-ci-validator)
Your own site
<a href="https://agentmods.dev/skills/akin-ozer/cc-devops-skills/gitlab-ci-validator"><img src="https://agentmods.dev/badge/skills/akin-ozer/cc-devops-skills/gitlab-ci-validator/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for gitlab-ci-validator

Your own site · 80×15
<a href="https://agentmods.dev/skills/akin-ozer/cc-devops-skills/gitlab-ci-validator"><img src="https://agentmods.dev/badge/skills/akin-ozer/cc-devops-skills/gitlab-ci-validator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 25 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,528 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • Socket pass 15 Sept 2026
  • Snyk pass 15 Sept 2026
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00025 $0.01528
Opus 5.5 $0.00010 $0.00611
Sonnet 5.5 $0.00005 $0.00306
Haiku 4.5 $0.00003 $0.00153

Measured 2mo ago against content hash 0cbfbb143131, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

gitlab-ci-validator scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

The scan reads SKILL.md. This mod also ships 7 executable files (scripts/check_best_practices.py, scripts/check_security.py, scripts/install_tools.sh, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- Security rules (`hardcoded-password`, `curl-pipe-bash`, `include-remote-unverified`): reduce credential leaks and supply-chain risk.
devops-skills-plugin/skills/gitlab-ci-validator/SKILL.md · 179 lines

How it starts

The opening of the file, as written. The whole thing — 179 lines — stays where its author put it; the contents beside it link to each section on GitHub.

GitLab CI/CD Validator

Comprehensive toolkit for validating, linting, testing, and securing .gitlab-ci.yml configurations.

Trigger Phrases

Use this skill when requests include intent like:

  • "Validate this .gitlab-ci.yml"
  • "Why is this GitLab pipeline failing?"
  • "Run a security review for our GitLab CI"
  • "Check pipeline best practices"
  • "Lint GitLab CI config before merge"

Setup And Prerequisites (Run First)

All commands below assume repository root as current working directory.

# Ensure validator scripts are executable
chmod +x devops-skills-plugin/skills/gitlab-ci-validator/scripts/*.sh \
  devops-skills-plugin/skills/gitlab-ci-validator/scripts/*.py

# Required runtime
python3 --version

Use one canonical command path for orchestration:

VALIDATOR="bash devops-skills-plugin/skills/gitlab-ci-validator/scripts/validate_gitlab_ci.sh"

Optional local execution tooling (for --test-only):

bash devops-skills-plugin/skills/gitlab-ci-validator/scripts/install_tools.sh

Quick Start Commands

# 1) Full validation (syntax + best practices + security)
$VALIDATOR .gitlab-ci.yml

# 2) Syntax and schema only (required first gate)
$VALIDATOR .gitlab-ci.yml --syntax-only

# 3) Best-practices only (recommended)
$VALIDATOR .gitlab-ci.yml --best-practices

# 4) Security only (required before merge)
$VALIDATOR .gitlab-ci.yml --security-only

# 5) Optional local pipeline structure test (needs gitlab-ci-local + Docker)
$VALIDATOR .gitlab-ci.yml --test-only

# 6) Strict mode (treat best-practice warnings as failure)
$VALIDATOR .gitlab-ci.yml --strict

Deterministic Validation Workflow

Follow these gates in order:

  1. Run Quick Start command 2 (--syntax-only).
  2. If syntax fails, stop and fix errors before continuing.
  3. Run Quick Start command 3 (--best-practices) and apply relevant improvements.
  4. Run Quick Start command 4 (--security-only) and fix all critical/high findings before merge.
  5. Optionally run Quick Start command 5 (--test-only) for local execution checks.
  6. Run Quick Start command 6 (--strict) for final merge gate.

Read the full file on GitHub · 179 lines

Files

What ships with it

20 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 179 lines · 25 tokens per session scan A 0cbfbb143131

Subscribe to this mod's changes

gitlab-ci-validator is a skill published in the GitHub repository akin-ozer/cc-devops-skills (332 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 25 tokens to every session and 1,528 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

CI and CDDevOps and cloud
Related

gitlab-ci-validator compared with skills from other repositories

gitlab-ci-validator next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
gitlab-ci-validatorakin-ozer/cc-devops-skillsSkill3323mo agoApache-2.0A25Claude Code
chinese-git-workflowjnMetaCode/superpowers-zhSkill8.5k11d agoMITA69Claude Code
atmos-profilescloudposse/atmosSkill1.4kyesterdayApache-2.0A35Claude Code
webhook-managementhoangsonww/Claude-Code-Agent-MonitorSkill1.1kyesterdayMITA56Claude Code, Codex
monorepo-managementwshobson/agentsSkill42kyesterdayMITC54Claude Code
managing-github-actions-secretsPostHog/posthog-fossSkill728yesterdayMITA67Claude Code, Codex
postman-newman-automationLambdaTest/agent-skillsSkill390yesterdayMITA156Claude Code, Codex