CI/CD & Docker Security Linter

The problem

CI/CD pipelines and container configurations often harbor silent security risks outside of application source code. Misconfigured Dockerfiles or GitHub Actions workflows can lead to root escalations, supply chain attacks, and secret leakage.

What it does

• Identifies Dockerfiles running as root or using unpinned 'latest' base image tags.
• Flags dangerous docker-compose settings like privileged mode or Docker socket mounts.
• Detects insecure GitHub Actions patterns including pull_request_target misuse and unpinned commit SHAs.
• Scans for hardcoded secrets in ARG/ENV instructions and unsafe echoing of secrets in pipeline logs.
• Generates structured findings compatible with security-hygiene-checklist and security-audit-report formats.

Frameworks & tools

Docker, docker-compose, GitHub Actions, and Python.

Why this beats prompting it yourself

General LLM prompts often miss subtle CI/CD attack vectors like mutable tag hijacking or specific GitHub token permission over-scoping. This skill uses a codified checklist of high-impact misconfigurations, ensuring you don't overlook complex supply chain risks during a manual review.

Use cases

• Hardening container images before pushing to a production registry.
• Auditing GitHub Actions workflows for repositories accepting external pull requests.
• Reviewing docker-compose files to ensure proper network and volume isolation.
• Preparing a repository for public release or a security audit.

Known limitations

Uses regex-based parsing which may miss issues in complex YAML structures like anchors. It does not analyze the internal source code of third-party GitHub Actions.