CI/CD Agent Skills

Create, apply, and manage AgentRC policies to customize readiness scoring, disable checks, override impact levels, set pass-rate thresholds, and enforce CI gating.

Automates repeated rounds of Copilot code review on GitHub pull requests: triggers review, triages threads, dispatches parallel fix agents, commits, replies, and loops until convergence.

Create, configure, and deploy Azure Static Web Apps using the SWA CLI, including local development, runtime configuration, and CI/CD setup.

Generates a complete GitHub Copilot configuration for a new project, including instructions, reusable skills, and agent definitions tailored to the technology stack.

Audits Python + BigQuery pipelines for cost safety, idempotency, and production readiness, returning a structured report with exact patch locations.

Reviews and hardens GitHub Actions workflows against injection, privilege escalation, supply-chain, and token-scoping risks that pattern matchers miss.

Routes requests to design, create, update, debug, or upgrade GitHub Agentic Workflows by loading the appropriate workflow prompt or skill file.

Audit GitHub Actions workflow efficiency and recommend fixes to reduce CI minutes and costs.

Build, test, lint, version, and publish production-grade Python libraries to PyPI with support for multiple build backends, versioning strategies, and CI/CD.

Generate tailored AI agent instruction files for VS Code Copilot and other coding agents, using AgentRC to analyze your codebase and produce flat or nested instruction files with optional per-area scoping.

Creates a formal, AI-optimized specification for an existing GitHub Actions CI/CD workflow, focusing on behavior and requirements rather than implementation details.

Run Semgrep static analysis scans with automatic language detection, parallel subagent execution, and merged SARIF output. Supports full ruleset coverage or high-confidence security vulnerability filtering.

Parse, analyze, and process SARIF files from static analysis tools like CodeQL and Semgrep, including filtering, deduplication, aggregation, and CI/CD integration.

Prepares codebases for security review using Trail of Bits' checklist by setting review goals, running static analysis, increasing test coverage, removing dead code, and generating documentation.

Automate Codacy code quality operations through Composio's Codacy toolkit via Rube MCP.

Automate Prisma database operations through Composio's Prisma toolkit via Rube MCP, including tool discovery, connection management, and execution.

Automate Seqera operations through Composio's Seqera toolkit via Rube MCP, with tool discovery and connection management.

Automate Appveyor CI/CD operations through Composio's toolkit via Rube MCP, including tool discovery, connection management, and workflow execution.

Automate Conveyor operations by discovering and executing tools through Rube MCP and Composio's Conveyor toolkit.

Automate Signpath operations through Composio's Signpath toolkit via Rube MCP, including tool discovery, connection management, and execution.

Automate Appcircle CI/CD operations through Composio's Appcircle toolkit via Rube MCP, with tool discovery and connection management.

Automate Buildkite CI/CD operations through Composio's toolkit via Rube MCP, including pipeline management and job execution.

Automate Fluxguard operations through Composio's Fluxguard toolkit via Rube MCP, with dynamic tool discovery and connection management.

Interact with GitHub repositories using the `gh` CLI to manage issues, pull requests, CI runs, and query the GitHub API.

Run autonomous optimization loops that iteratively improve artifacts against evaluators using hypothesis tree refinement, without overfitting.

Build, run, and debug Nextflow data pipelines and nf-core workflows end to end, covering processes, channels, operators, configuration, testing, and deployment to HPC or cloud.

Validates inputs, generates samplesheets and launch scripts, and optionally executes nf-core/pacsomatic matched tumor-normal workflows from BAM files, supporting local runs and scheduler submission (LSF/Slurm/PBS/SGE).

Handles git and GitHub operations using the gh CLI, triggered by any github.com URL. Covers creating and reviewing PRs, watching CI checks, interactive rebasing, branch cleanup, submodule management, and repository archaeology.

Provides deep expertise in Node.js internals: V8 engine, libuv event loop, native addon development, build systems, and performance debugging.

Generate CycloneDX and SPDX SBOMs from container images and filesystems, scan them for vulnerabilities with Grype, and sign attestations with Cosign for supply-chain trust.

Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, OSSGadget, and pypi-scan.

Scan Docker images for vulnerabilities, misconfigurations, secrets, and license violations using Trivy, with CI/CD integration and policy enforcement.

Hardens GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation by pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, preventing script injection, and implementing workflow change controls.

Scan container images, IaC, and SBOMs for vulnerabilities and misconfigurations in CI/CD with Trivy.

Scan container images for vulnerabilities with Trivy and Grype, generate SBOMs, sign images with Cosign and Sigstore, configure registry access controls, and enforce security gates in CI/CD pipelines.

Enforce deploy-time security controls that ensure only trusted, attested container images are deployed to Google Kubernetes Engine and Cloud Run.