Inspect CI and skill supply-chain boundaries

How these skills work together

Map untrusted events and privileged operations in CI, then inventory the actions, scripts and skills involved. Read each selected source and dependency declaration without executing it. Trace a suspicious pattern to a concrete data-flow or permission issue, retaining exact file versions and coverage limits.

Validation and boundaries

Require evidence and conditions for each finding, distinguish legitimate examples from executable paths, and test only in a suitable isolated environment. A clean pattern scan does not certify runtime safety. Review the scanner itself before executing it, and keep recommendations separate from permission to change credentials or deploy.