Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rshankras/claude-code-apple-skills --skill ci-cd-setupgit clone --depth 1 https://github.com/rshankras/claude-code-apple-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rshankras/claude-code-apple-skills/ci-cd-setup)<a href="https://agentmods.dev/skills/rshankras/claude-code-apple-skills/ci-cd-setup"><img src="https://agentmods.dev/badge/skills/rshankras/claude-code-apple-skills/ci-cd-setup.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 138 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.01557 |
| Opus 5 | $0.00026 | $0.00779 |
| Sonnet 5 | $0.00010 | $0.00311 |
| Haiku 4.5 | $0.00005 | $0.00156 |
Grade A, and why
ci-cd-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 202 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CI/CD Setup Generator
Generate CI/CD configuration for automated builds, tests, and distribution of iOS/macOS apps.
When This Skill Activates
- User wants to automate their build and test process
- User mentions GitHub Actions, Xcode Cloud, or fastlane
- User wants to set up TestFlight or App Store deployment
- User asks about continuous integration for their app
Pre-Generation Checks
Before generating, verify:
-
Existing CI Configuration
# Check for existing CI files ls -la .github/workflows/ 2>/dev/null ls -la ci_scripts/ 2>/dev/null ls -la fastlane/ 2>/dev/null -
Project Structure
# Find Xcode project/workspace find . -name "*.xcodeproj" -o -name "*.xcworkspace" | head -5 -
Package Manager
# Check for SPM vs CocoaPods ls Package.swift 2>/dev/null ls Podfile 2>/dev/null
Configuration Questions
1. CI/CD Platform
- GitHub Actions (Recommended) - Full control, extensive marketplace
- Xcode Cloud - Native Apple integration, simpler setup
- Both - GitHub for PRs/tests, Xcode Cloud for releases
2. Distribution Method
- TestFlight - Beta testing via App Store Connect
- App Store - Production releases
- Direct (macOS only) - Notarized DMG/PKG distribution
- All - Full pipeline from dev to production
3. Include fastlane?
- Yes - Advanced automation, match for code signing
- No - Simpler setup using xcodebuild directly
4. Code Signing Approach
- Manual - Certificates in GitHub Secrets
- match (fastlane) - Git-based certificate management
- Xcode Cloud Managed - Apple handles signing
Generated Files
GitHub Actions
.github/workflows/
├── build-test.yml # PR checks, unit tests
├── deploy-testflight.yml # TestFlight deployment
└── deploy-appstore.yml # App Store submission
Xcode Cloud
ci_scripts/
├── ci_post_clone.sh # Post-clone setup
└── ci_pre_xcodebuild.sh # Pre-build configuration
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- ci-cd-patterns.md 9.6 KB
- templates/fastlane/Appfile 2.1 KB
- templates/fastlane/Fastfile 6.9 KB
- templates/fastlane/Matchfile 2.7 KB
- templates/github-actions/build-test.yml 3.7 KB
- templates/github-actions/deploy-appstore.yml 6.8 KB
- templates/github-actions/deploy-testflight.yml 5.9 KB
- templates/swiftlint/swiftlint.yml 1.1 KB
- templates/xcode-cloud/ci_post_clone.sh 2.7 KB runs code
- templates/xcode-cloud/ci_pre_xcodebuild.sh 3.3 KB runs code
- templates/xcode-cloud/XcodeCloudSetup.md 5.1 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 202 lines · 52 tokens per session scan A 2a608304643a
ci-cd-setup is a skill published in the GitHub repository rshankras/claude-code-apple-skills (708 stars, last pushed 1mo ago), licensed MIT. It adds 52 tokens to every session and 1,557 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
devops-cloud
DevOps, cloud infrastructure, and platform engineering. Use when working with AWS, GCP, Azure, Kubernetes, Terraform, CI/CD pipelines, or infrastructure as code.
terraform-ops
Terraform and OpenTofu infrastructure-as-code operations - project layout, state management, module design, plan/apply safety, CI/CD pipelines, and secrets. Use for: terraform, opentofu, infrastructure as code, IaC, tfstate, terraform state, terraform module, remote backend, terraform plan, terraform apply, foreach…
cloudflare-ops
Cloudflare Workers + Wrangler edge ops: runtime, bindings, local dev, secrets, deploy/CI, Pages-vs-Workers. Triggers on: cloudflare workers, wrangler, wrangler deploy, wrangler.toml, KV, D1, R2, durable objects, queues, vectorize, compatibilitydate, edge functions, illegal invocation, waitUntil, caches API, smart…
pypi-ops
Publish Python packages to PyPI via OIDC Trusted Publishing (PEP 740 attestations, gh-action-pypi-publish) instead of stored tokens. Use for: invalid-publisher errors, pending-publisher 404s, uv publish/twine, TestPyPI, environment approval gates, and rotating/auditing publish tokens.
ci-cd-ops
CI/CD pipeline patterns with GitHub Actions, release automation, and testing strategies. Use for: github actions, workflow, CI, CD, pipeline, deploy, release, semantic release, changesets, goreleaser, matrix, cache, secrets, environment, artifact, reusable workflow, composite action.
devops-commander
Activates the DevOps-Commander agent for infrastructure, CI/CD, and cloud operations. Use when you need GitHub Actions or GitLab CI pipeline design, Dockerfile and docker-compose configuration, Kubernetes deployment manifests, Terraform/Pulumi infrastructure as code, Prometheus + Grafana monitoring setup, or incident…