Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/nimadorostkar/Claude-Skills-collectionnpx agentmods add skills/nimadorostkar/claude-skills-collection/ci-cdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nimadorostkar/claude-skills-collection/ci-cd)<a href="https://agentmods.dev/skills/nimadorostkar/claude-skills-collection/ci-cd"><img src="https://agentmods.dev/badge/skills/nimadorostkar/claude-skills-collection/ci-cd/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nimadorostkar/claude-skills-collection/ci-cd"><img src="https://agentmods.dev/badge/skills/nimadorostkar/claude-skills-collection/ci-cd.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.01231 |
| Opus 5 | $0.00021 | $0.00616 |
| Sonnet 5 | $0.00008 | $0.00246 |
| Haiku 4.5 | $0.00004 | $0.00123 |
Grade A, and why
ci-cd scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CI/CD
Purpose
Build a pipeline that catches problems before production and is fast enough that engineers do not learn to ignore it. A twenty-minute CI run is a pipeline people bypass.
When to Use
- Setting up CI/CD for a new project.
- A pipeline that is slow, flaky, or routinely skipped.
- Introducing a safer deployment strategy.
- Managing secrets and deployment credentials.
Capabilities
- Pipeline structure: what runs on every commit, what runs on merge, what runs on release.
- Caching and parallelization to cut wall-clock time.
- Deployment strategies: blue/green, canary, rolling, feature flags.
- Secrets management and OIDC-based cloud authentication.
- Flaky-test detection and quarantine.
Inputs
- The repository, its test suite, and current pipeline timings.
- The deployment target and its rollback capability.
- Compliance requirements: approvals, audit trail, signed artifacts.
Outputs
- A pipeline with a fast feedback stage and a thorough merge stage.
- Deployments that are observable and reversible.
- No long-lived cloud credentials in CI.
Workflow
- Split fast from thorough — Lint, type-check, and unit tests on every push, in under five minutes. Integration, E2E, and security scans on the merge queue or on main.
- Cache the right things — Dependencies, build artifacts, and Docker layers. A cache keyed on the lockfile hash is correct; one keyed on the branch is a source of stale-build mysteries.
- Parallelize the test suite — Shard by timing, not alphabetically. The slowest shard determines the wall clock.
- Deploy progressively — Canary to a small percentage, watch the error rate and latency, then proceed. Automate the abort.
- Authenticate with OIDC — Short-lived tokens federated from the CI provider to the cloud. A long-lived access key in CI secrets is a breach waiting to be exfiltrated by a malicious dependency.
- Track flakes — A test that fails 2% of the time will train the team to re-run the pipeline reflexively, at which point CI has stopped working.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 113 lines · 42 tokens per session scan A 17223b5555e6
ci-cd is a skill published in the GitHub repository nimadorostkar/Claude-Skills-collection (26 stars, last pushed 23d ago), licensed MIT. It adds 42 tokens to every session and 1,231 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
gsd-core-hooks
A full PreToolUse/PostToolUse hook suite that machine-enforces a project's workflow rules instead of leaving them as prose — a passing test-runner verdict bound to the exact commit sha before push, no local node --test, Memtrace-first code discovery, no-defer artifact gating for long directives, and a family of guards…
offensive-fuzzing
Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers…
offensive-business-logic
Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows…
offensive-race-condition
Race condition (TOCTOU) testing checklist: identifying timing windows, Burp Suite Turbo Intruder, Last-Byte sync technique, rate limit bypass, double-spend attacks, and concurrent request exploitation. Use for web app race condition testing or bug bounty time-of-check-to-time-of-use bugs.
smoke-test
Launch the app and hands-on verify that it works by interacting with it. Falls back to an existing integration test suite when there is no interactive surface in scope. Use when the user asks to "smoke test", "test it manually", "verify it works", "try it out", "run a smoke test", "check it in the browser", or "does…
exploratory-test
Execute multi-level exploratory testing of the app covering basic functionality, complex operations, adversarial testing, and cross-cutting scenarios, plus usability observations through a UX lens reported separately from defects. Deeper than /smoke-test. Use when the user asks to "exploratory test", "test…