Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add seed-forge/harness-ai-kit --skill devlab-cicd-onboardgit clone --depth 1 https://github.com/seed-forge/harness-ai-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seed-forge/harness-ai-kit/devlab-cicd-onboard)<a href="https://agentmods.dev/skills/seed-forge/harness-ai-kit/devlab-cicd-onboard"><img src="https://agentmods.dev/badge/skills/seed-forge/harness-ai-kit/devlab-cicd-onboard.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 16 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.01058 |
| Opus 5 | $0.00014 | $0.00529 |
| Sonnet 5 | $0.00006 | $0.00212 |
| Haiku 4.5 | $0.00003 | $0.00106 |
Grade A, and why
devlab-cicd-onboard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DevLab CI/CD Onboard
Purpose
Use this Skill to introduce or evolve CI/CD in an application repository. It turns repository facts into a provider-neutral plan, then produces reviewed workflow and configuration changes for GitHub Actions, Jenkins, Woodpecker, or another established CI platform.
It is an engineering workflow, not a platform-administration runbook. It does not create accounts, change global CI settings, install plugins, or access credentials.
Inputs
- Repository path or source archive.
- Requested outcome: CI only, deployment pipeline, an environment change, or a migration between CI providers.
- Optional target environments and the CI provider already used by the team.
Outputs
- A short repository and delivery-path assessment.
- A reviewed pipeline design and project-local configuration template.
- Workflow files or a patch when the repository has enough confirmed context.
- A structured escalation when a CI platform, secret, runner, or deployment prerequisite needs an operator.
Workflow
- Inspect the repository before selecting a provider: language, package manager, tests, build output, containerization, deployment target, and any existing CI files.
- Select the smallest provider-compatible path. Preserve an existing working provider unless the request explicitly asks for migration. For a new public repository, GitHub Actions is the default recommendation.
- Separate configuration by ownership:
- versioned repository configuration contains only non-secret, portable values and placeholders;
- CI secret stores hold tokens, SSH keys, registry credentials, and private endpoints;
- platform-wide runners, plugins, credentials, and permissions remain operator-owned.
- Produce a pipeline with explicit stages: dependency install, deterministic tests, build, artifact publication, optional deployment, and verification. A deployment must not happen until its target, credential reference, and rollback path are confirmed.
- Offer quality gates as explicit, opt-in steps. Keep pull-request checks fast; prove each enabled gate with one intentional failure and one success.
- Validate the generated YAML and scripts locally where possible. Then verify the provider run, artifact availability, and the deployed service contract separately.
- Return an escalation instead of guessing when a required secret, runner capability, DNS rule, network path, approval, or deployment target is unknown.
What ships with it
13 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- CHANGELOG.md 1.0 KB
- config.defaults.yaml 689 B
- decisions.yaml 846 B
- README.md 383 B
- REFERENCE-ESCALATION-BOUNDARY.md 1.2 KB
- REFERENCE-ROUTE-TABLE.md 2.6 KB
- references/jenkins-yml-schema.json 4.1 KB
- references/REFERENCE-PORTABLE-CICD-PATTERNS.md 3.1 KB
- references/REFERENCE-README.md 151 B
- scripts/sync-service-list.sh 2.6 KB runs code
- scripts/validate-jenkins-yml.py 5.8 KB runs code
- skill.json 2.2 KB
- USAGE.md 1.0 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 118 lines · 28 tokens per session scan A fa6b38d0a49d
devlab-cicd-onboard is a skill published in the GitHub repository seed-forge/harness-ai-kit (22 stars, last pushed 7d ago), licensed Apache-2.0. It adds 28 tokens to every session and 1,058 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
audit-cicd
Audit CI/CD pipelines (GitHub Actions) for cost, speed, and safety. Use when the Actions bill is high, Actions minutes, runner cost, slow CI, artifact/cache storage, or "CI/CD / workflow audit". Gate logic (bypass, ratchet gaming, required-but-not) → audit-gate-logic.
Prompt Version Control Workflow
Sets up a prompt versioning system with naming conventions, diff tracking, A/B evaluation gates before promotion, and rollback triggers.
audit-gate-logic
Read-only audit of CI gate logic — silent bypass, ratchet gaming, required-but-not, duplicate gates. Use when "can CI be bypassed" or "why did a regression pass CI". Cost → audit-cicd. Consolidation → housekeep-gates. Rule content → audit-doctrine.
housekeep-gates
Apply-now consolidation of accreted CI gates, ratchets, and hooks into one aggregator required check. Use after audit-gate-logic, or when "clean up our CI checks", "we have three lint jobs", "make one quality gate". Audit-only → audit-gate-logic. Rule content → audit-doctrine. Pipeline cost → audit-cicd.
enhance-arch-boundaries
Install mechanically-enforced architecture boundaries (dependency-cruiser / eslint-boundaries) so layer direction, feature isolation, and forbidden imports fail CI. Use when "enforce module boundaries" or "stop spaghetti imports". Advisory audit → audit-backend-architecture. Rule content → audit-doctrine.
mobile-capacitor-platform
Handle Capacitor platform depth beyond UI: plugins, OTA, deep links, push, offline, native CI/CD, App Store / Play Store submission, Apple preflight, security scan, Cordova migration. Use for "add push notifications", "deep linking", "OTA update", "native build CI", "App Store rejection", "migrate to Capacitor".