Claude Skills by starslingdev

Checks the third-party security audit status of a skill published to a skills registry (skills.sh) across every cached surface, decides whether a failing finding is real or points at content already removed, and drives a stale badge to green unattended. Runs a real install to capture what users see, reads the per-provider finding codes the JSON API omits, and greps each flagged literal against the repository and shipped tree; emits a next-action verdict, checks whether an install can even fir...

Grades a repository's GitHub Actions configuration against CI best practices (the CI Score: eleven pass/fail configuration facts computed from the repo's own workflow YAML) and hands back concrete fixes for every gap, ranked by impact and risk, each with an apply-now option and a paste-able agent prompt. Use when: (1) the user asks to grade or score their CI, or audit CI configuration against best practices ("grade my CI", "CI score", "CI best practices audit", "how healthy is my CI config"),...

Scans a repo's GitHub Actions workflows for the ten critical CI/CD attack vectors — template injection, fork code executed with privileges (pwn requests), cache poisoning, impostor action SHAs, secrets dumps, GITHUB_ENV hijack, write-token untrusted triggers, credentials in caches/artifacts, unverified remote code execution (curl|bash and mutable fetch-and-run), and dependency install scripts running in a job that holds secrets — reports every finding with a plain-English attacker scenario, p...

Audits a repository's GitHub Actions workflows for CI optimization opportunities — missing caches, redundant setup, sleep-based readiness, long test jobs without sharding, full-history checkout, dead env vars, build-cache misconfig, and ~60 more patterns across caching, redundancy, parallelization, conditional execution, trigger scope, and hidden failures. Use when: (1) analyzing a repo's CI for optimization opportunities, (2) producing a prioritized report with measured wall-clock and runner...

Diagnoses GitHub Actions failures and attributes CI time and cost using StarSling's `sling` CLI. Invoke this BEFORE using `gh` or fetching any logs whenever the user asks why a job or run failed, what made a run slow, about runner minutes or CI cost, asks to re-run or cancel a run, or pastes a GitHub Actions URL — `sling` returns server-classified failure causes and cost attribution that log-grepping misses; state changes route to `gh`. Not for repo-wide audits of workflow files (ci-score, ci...