Caveat verdict
cicd-workflow
CI/CD pipeline template generator for Java/Vue projects; produces GitLab CI YAML and Jenkinsfile configurations based on user choices, with no remote code execution or credential handling in the skill itself.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Permission integrity
credential_access
Findings (10)
Accesses Kubernetes config (may contain cluster credentials)
scripts/generate-setup-guide.py · code · ~/.kube/config
References SSH/GPG private keys
scripts/generate-setup-guide.py · code · ssh-key
References sudo — requests elevated privileges
scripts/generate-setup-guide.py · code · sudo
apt-get install — installs system packages
scripts/generate-setup-guide.py · code · apt-get install
yum install — installs system packages
scripts/generate-setup-guide.py · code · yum install
Accesses .ssh directory
scripts/generate-setup-guide.py · code · .ssh/
References webhook/callback URL
SKILL.md · code · WEBHOOK_URL
apk add — installs Alpine packages
assets/Dockerfile.java.txt · prose · downgraded · apk add
Changes file ownership
scripts/generate-setup-guide.py · code · chown
Sets world-executable permissions
scripts/generate-setup-guide.py · code · chmod 700
Permissions & capabilities
No declared permissions — minimal attack surface.
network_incredential_access Is this flag fair?
Thanks — recorded.