Borrowing it
Nothing to install: this file belongs to Hack23/European-Parliament-MCP-Server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Hack23/European-Parliament-MCP-Server/main/.github/skills/github-actions-workflows/SKILL.mdgit clone --depth 1 https://github.com/Hack23/European-Parliament-MCP-ServerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hack23/european-parliament-mcp-server/github-actions-workflows)<a href="https://agentmods.dev/skills/hack23/european-parliament-mcp-server/github-actions-workflows"><img src="https://agentmods.dev/badge/skills/hack23/european-parliament-mcp-server/github-actions-workflows/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hack23/european-parliament-mcp-server/github-actions-workflows"><img src="https://agentmods.dev/badge/skills/hack23/european-parliament-mcp-server/github-actions-workflows.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 114 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.01569 |
| Opus 5.5 | $0.00019 | $0.00628 |
| Sonnet 5.5 | $0.00010 | $0.00314 |
| Haiku 4.5 | $0.00005 | $0.00157 |
Grade A, and why
github-actions-workflows scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 131 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Actions Workflows Skill
Purpose
Create and maintain secure, efficient CI/CD pipelines using GitHub Actions for this TypeScript 6.0.2 / Node.js 25 MCP server project with 12 automated workflows.
When to Use
- ✅ Setting up or modifying CI/CD pipelines for TypeScript MCP projects
- ✅ Automating security scans (CodeQL, dependency review, SLSA, SBOM)
- ✅ Implementing npm package publishing with attestation
- ✅ Configuring test/coverage reporting and quality gates
- ✅ Understanding the 8-stage pipeline architecture
Current Pipeline Architecture (12 Workflows)
| Stage | Workflow | Trigger | Purpose |
|---|---|---|---|
| 1. Code Validation | dependency-review.yml, labeler.yml |
PR | Dependency audit, auto-labeling |
| 2. Build & Test | test-and-report.yml |
Push, PR | Lint, build, test, coverage (80%+) |
| 3. Security Analysis | codeql.yml |
Push, PR, Weekly | CodeQL SAST scanning |
| 4. Integration Testing | integration-tests.yml |
Push, PR, Daily | E2E tests against EP API |
| 5. Release & Publish | release.yml |
Tag v*, Manual |
npm publish with attestation |
| 6. Supply Chain | sbom-generation.yml, slsa-provenance.yml |
Push (main), Tag v*, Release publish, Manual |
CycloneDX/SPDX SBOM, SLSA Level 3 |
| 7. Continuous Monitoring | scorecard.yml |
Push, Weekly | OpenSSF Scorecard |
| 8. Repository Management | setup-labels.yml, copilot-setup-steps.yml, refresh-stats.yml |
Manual, Push, Schedule | Labels, Copilot environment, Stats refresh |
CI/CD Pattern (Node.js 25 + TypeScript 6.0.2)
name: Test and Report
on:
push:
branches: [main]
pull_request:
branches: [main]
permissions:
contents: read
checks: write
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
with:
egress-policy: audit
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: '25'
cache: 'npm'
- run: npm ci
- run: npm run lint
- run: npm run build
- run: npm run test:coverage
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 131 lines · 48 tokens per session scan A 580b49b93251
github-actions-workflows is a skill published in the GitHub repository Hack23/European-Parliament-MCP-Server (29 stars, last pushed yesterday), licensed Apache-2.0. It adds 48 tokens to every session and 1,569 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
flutter-mcp-toolkit-repo-maintainer
Maintain mcpflutter releases, CHANGELOG, version pins, docs, and CI. Use when cutting a release, editing CHANGELOG.md, bumping VERSION, running release-please, sync-skills, check-contracts, or updating install/docs for npx skills and flutter-mcp-toolkit init.
publish-specimen
MUST READ before publishing a Specimen from the lab to the embody.tools Collection -- the full path from a built /specimenlab COMP through the user's approval to a verified live card: export, prompt, cover, manifest, generated site data, local checks, commit, PR to main, Platform CI deploy + sync-specimens, live…
servicenow-studio-gitlab-app
Wire a ServiceNow scoped app (App Engine Studio / Fluent) to a GitLab repository and drive its promotion two ways — Path A: native Studio source control (servicenowsourcecontrol → importrepository / applyremotesourcecontrolchanges, handing off to servicenowcicd for publish/install), or Path B: GitLab-CI-driven…
servicenow-cicd-devops
ServiceNow release-engineering surface — CI/CD app install/scan/rollback, DevOps change-control and artifact registration, update-set create/preview/commit/back-out, source-control apply/import, plugin activate/rollback, and ATF test-suite runs via the servicenow-api MCP server. Use when the agent must deploy or roll…
orchardcore-docker
Skill for containerizing Orchard Core with Docker. Covers multi-stage and multi-platform Dockerfiles, dockerignore configuration, docker compose with multiple database providers, persistent AppData and temporary file volumes, configuring Orchard Core 4 through environment variables with the renamed configuration…
gitlab-pipelines
CI/CD pipeline review on GitLab via the gitlab-api MCP server — review pipeline results for a project, a group, or the whole instance, drill into the CI jobs of a pipeline, and read a job's log; also trigger a pipeline on a ref. Use when the agent must review CI results across a project/group/organization, check…