gitlab-ci-patterns
Warn
Audited by Socket on Feb 27, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
This skill contains GitLab CI templates that are consistent with its stated purpose. It does not contain hidden backdoors or direct exfiltration code, but the templates include patterns that increase supply-chain and credential risk in real deployments (insecure TLS flag for kubectl, docker:dind usage, unpinned 'latest' images, dynamic child-pipeline generation). These are operational security concerns rather than evidence of malware. Operators should pin images, avoid --insecure-skip-tls-verify, limit docker:dind/privileged runners, protect/mask CI variables, and validate generated child pipelines to reduce risk.
Confidence: 75%Severity: 75%
Audit Metadata