Skip to content
Get packs

GitLab DevSecOps Pipeline Builder

Sets up a GitLab CI pipeline with SAST, DAST, container, dependency and secret scanning stages

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

Once installed, the agent can write a GitLab CI configuration (.gitlab-ci.yml) that includes GitLab's built-in security scanners, such as static code analysis, dependency checks, container image scanning, secret detection and dynamic testing of a running staging app. It also explains how to add approval policies and where scanner findings appear in GitLab's Vulnerability Report. The bundled scripts can generate a pipeline template and query the GitLab API to compile security scan results across projects into a report.

Great for

  • Engineering teams using GitLab who want security scanning built into every merge request and deployment
  • DevOps or platform engineers adding a shift-left security stage to an existing pipeline
  • Security teams who want a starting template and a cross-project scan report

Skip it if

  • Teams not on GitLab or without a GitLab Ultimate license, since the full scanner suite depends on it (the skill lists this as a prerequisite)
  • Anyone expecting the scripts to be a finished, tested tool: the pipeline example and scripts are not verified against a live GitLab instance in the files provided
  • Running the generated pipeline unreviewed against production: it includes automatic deploy jobs and kubectl commands that must be adapted to your environment

Try asking

  • “Create a .gitlab-ci.yml with SAST, secret detection, dependency and container scanning for my Node.js app”
  • “Add a DAST stage that scans our staging URL after deployment”
  • “Explain how to set up a merge request approval policy for critical vulnerabilities in GitLab”
  • “Write a script that pulls security findings for all projects in our GitLab group”
Step-by-step guide: how to use GitLab DevSecOps Pipeline BuilderInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    building-devsecops-pipeline-with-gitlab-ci.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip building-devsecops-pipeline-with-gitlab-ci.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip building-devsecops-pipeline-with-gitlab-ci.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review and replace the example URLs (staging.example.com), image tags and kubectl commands before using the pipeline template
  • Store GitLab API tokens in CI/CD variables or a secrets manager, never in the repository, and use a token with the minimum scope needed
  • Run the Python scripts first against a test group, since they make live API calls with your token and print API error bodies to the console

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.