concourse-ci
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were detected in the analyzed files. The skill focuses on providing educational resources and templates for Concourse CI.
- [COMMAND_EXECUTION]: The
scripts/validate-pipeline.shutility script performs local YAML validation using standard tools likeyq,python3, and theflyCLI. All inputs are properly quoted, and the script's behavior is consistent with its stated purpose of linting pipeline configurations. - [EXTERNAL_DOWNLOADS]: The pipeline examples and documentation reference established Concourse community resources (e.g.,
cfcommunity/slack-notification-resource,arbourd/concourse-slack-alert-resource). These are standard dependencies in the Concourse ecosystem. - [CREDENTIALS_SAFE]: The skill actively encourages security best practices by providing examples that use variables (
((variable_name))) and external secret managers like HashiCorp Vault or AWS SSM, rather than hardcoding sensitive information. A checkpoint (CC-08) is included to explicitly detect and prevent hardcoded secrets in user pipelines.
Audit Metadata