Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/vibeeval/vibecosystemnpx agentmods add skills/vibeeval/vibecosystem/ci-cd-pipelineWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vibeeval/vibecosystem/ci-cd-pipeline)<a href="https://agentmods.dev/skills/vibeeval/vibecosystem/ci-cd-pipeline"><img src="https://agentmods.dev/badge/skills/vibeeval/vibecosystem/ci-cd-pipeline/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vibeeval/vibecosystem/ci-cd-pipeline"><img src="https://agentmods.dev/badge/skills/vibeeval/vibecosystem/ci-cd-pipeline.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.02990 |
| Opus 5 | $0.00014 | $0.01495 |
| Sonnet 5 | $0.00006 | $0.00598 |
| Haiku 4.5 | $0.00003 | $0.00299 |
Grade C, and why
ci-cd-pipeline scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf /tmp/.buildx-cache Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -f https://staging.example.com/health || exit 1 How it starts
The opening of the file, as written. The whole thing — 493 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CI/CD Pipeline Patterns
GitHub Actions workflows for consistent, fast, and reliable delivery pipelines.
Workflow Structure
# .github/workflows/ci.yml
name: CI
on:
push:
branches: [main, develop]
pull_request:
branches: [main]
workflow_dispatch: # manual trigger
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true # cancel outdated runs on same branch
jobs:
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
- run: npm ci
- run: npm run lint
test:
runs-on: ubuntu-latest
needs: lint # runs after lint passes
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
- run: npm ci
- run: npm test -- --coverage
build:
runs-on: ubuntu-latest
needs: test
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
- run: npm ci
- run: npm run build
Matrix Builds
Test across multiple versions and operating systems in parallel.
jobs:
test:
strategy:
fail-fast: false # don't cancel others if one fails
matrix:
node: ['18', '20', '22']
os: [ubuntu-latest, macos-latest, windows-latest]
exclude:
- os: windows-latest
node: '18' # skip this combination
runs-on: ${{ matrix.os }}
name: Test Node ${{ matrix.node }} on ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node }}
cache: 'npm'
- run: npm ci
- run: npm test
# Python matrix example
jobs:
test:
strategy:
matrix:
python: ['3.10', '3.11', '3.12']
django: ['4.2', '5.0']
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python }}
- run: pip install django==${{ matrix.django }} -r requirements-test.txt
- run: pytest
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 493 lines · 28 tokens per session scan C 4ab80794ea4d
ci-cd-pipeline is a skill published in the GitHub repository vibeeval/vibecosystem (529 stars, last pushed 1mo ago), licensed MIT. It adds 28 tokens to every session and 2,990 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
ci-pipeline
CI pipeline discipline: lint→build→test→quality→security, fail-fast, deterministic build, secret handling, PR gates.
test-e2e
End-to-end infrastructure pipeline validation across Terraform and Ansible repos.
tune-repo
Audit and tighten the current repository so Claude Code works faster and more accurately in it — verify the existing CLAUDE.md still matches reality, tighten the build/test/lint verification loop, add only the missing static guardrails, and reduce permission friction. Use when the user wants to "tune", "audit"…
github-release-management
GitHub release orchestration — automated versioning, testing, deployment, and rollback. Use when cutting a release, tagging a version, drafting release notes, or coordinating a deploy/rollback workflow.
test-automator
Use when you need to build, implement, or enhance automated test frameworks, create test scripts, or integrate testing into CI/CD pipelines.
verify-implementation
A workflow that runs a project’s verification skills to produce a report on coding patterns, architecture rules, and project conventions. It is intended for work after implementation, before a pull request, or during code review.