How do I install the Prowler CI skill?

Run npx skillmds add prowler-cloud/prowler-ci in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Prowler CI safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Prowler CI?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Prowler CI free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Prowler CI?

prowler-cloud (@prowler-cloud) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Prowler CI by prowler-cloud — Agent Skill

Name: Prowler CI
Rating: 4.2 (5 reviews)
Author: prowler-cloud

Prowler CI

Helps with Prowler repository CI and PR gates (GitHub Actions workflows). Trigger: When investigating CI checks failing on a PR, PR title validation, changelog gate/no-changelog label, conflict marker checks, secret scanning, CODEOWNERS/labeler automation, or anything under .github/workflows.

File contents

What this skill covers

Use this skill whenever you are:

Reading or changing GitHub Actions workflows under .github/workflows/
Explaining why a PR fails checks (title, changelog, conflict markers, secret scanning)
Figuring out which workflows run for UI/API/SDK changes and why
Diagnosing path-filtering behavior (why a workflow did/didn't run)

Quick map (where to look)

PR template: .github/pull_request_template.md
PR title validation: .github/workflows/conventional-commit.yml
Changelog gate: .github/workflows/pr-check-changelog.yml (requires a fragment under <component>/changelog.d/)
Changelog compile (release time): .github/workflows/compile-changelogs.yml
Conflict markers check: .github/workflows/pr-conflict-checker.yml
Secret scanning: .github/workflows/find-secrets.yml
Auto labels: .github/workflows/labeler.yml and .github/labeler.yml
Review ownership: .github/CODEOWNERS

Debug checklist (PR failing checks)

Identify which workflow/job is failing (name + file under .github/workflows/).
Check path filters: is the workflow supposed to run for your changed files?
If it's a title check: verify PR title matches Conventional Commits.
If it's changelog: verify a valid fragment exists under the right <component>/changelog.d/ OR apply no-changelog label.
If it's conflict checker: remove <<<<<<<, =======, >>>>>>> markers.
If it's secrets (TruffleHog): see section below.

TruffleHog Secret Scanning

TruffleHog scans for leaked secrets. Common false positives in test files:

Patterns that trigger TruffleHog:

sk-*T3BlbkFJ* - OpenAI API keys
AKIA[A-Z0-9]{16} - AWS Access Keys
ghp_* / gho_* - GitHub tokens
Base64-encoded strings that look like credentials

Fix for test files:

# BAD - looks like real OpenAI key
api_key = "sk-test1234567890T3BlbkFJtest1234567890"

# GOOD - obviously fake
api_key = "sk-fake-test-key-for-unit-testing-only"

If TruffleHog flags a real secret:

Remove the secret from the code immediately
Rotate the credential (it's now in git history)
Consider using .trufflehog-ignore for known false positives (rarely needed)

Notes

Keep prowler-pr focused on creating PRs and filling the template.
Use prowler-ci for CI policies and gates that apply to PRs.

---name: prowler-cidescription: Helps with Prowler repository CI and PR gates (GitHub Actions workflows). Trigger: When investigating CI checks failing on a PR, PR title validation, changelog gate/no-changelog label, conflict marker checks, secret scanning, CODEOWNERS/labeler automation, or anything under .github/workflows.license: Apache-2.0--- ## What this skill covers Use this skill whenever you are: - Reading or changing GitHub Actions workflows under `.github/workflows/` - Explaining why a PR fails checks (title, changelog, conflict markers, secret scanning) - Figuring out which workflows run for UI/API/SDK changes and why - Diagnosing path-filtering behavior (why a workflow did/didn't run) ## Quick map (where to look) - PR template: `.github/pull_request_template.md` - PR title validation: `.github/workflows/conventional-commit.yml` - Changelog gate: `.github/workflows/pr-check-changelog.yml` (requires a fragment under `<component>/changelog.d/`) - Changelog compile (release time): `.github/workflows/compile-changelogs.yml` - Conflict markers check: `.github/workflows/pr-conflict-checker.yml` - Secret scanning: `.github/workflows/find-secrets.yml` - Auto labels: `.github/workflows/labeler.yml` and `.github/labeler.yml` - Review ownership: `.github/CODEOWNERS` ## Debug checklist (PR failing checks) 1. Identify which workflow/job is failing (name + file under `.github/workflows/`). 2. Check path filters: is the workflow supposed to run for your changed files? 3. If it's a title check: verify PR title matches Conventional Commits. 4. If it's changelog: verify a valid fragment exists under the right `<component>/changelog.d/` OR apply `no-changelog` label. 5. If it's conflict checker: remove `<<<<<<<`, `=======`, `>>>>>>>` markers. 6. If it's secrets (TruffleHog): see section below. ## TruffleHog Secret Scanning TruffleHog scans for leaked secrets. Common false positives in test files: **Patterns that trigger TruffleHog:** - `sk-*T3BlbkFJ*` - OpenAI API keys - `AKIA[A-Z0-9]{16}` - AWS Access Keys - `ghp_*` / `gho_*` - GitHub tokens - Base64-encoded strings that look like credentials **Fix for test files:** ```python # BAD - looks like real OpenAI key api_key = "sk-test1234567890T3BlbkFJtest1234567890" # GOOD - obviously fake api_key = "sk-fake-test-key-for-unit-testing-only" ``` **If TruffleHog flags a real secret:** 1. Remove the secret from the code immediately 2. Rotate the credential (it's now in git history) 3. Consider using `.trufflehog-ignore` for known false positives (rarely needed) ## Notes - Keep `prowler-pr` focused on *creating* PRs and filling the template. - Use `prowler-ci` for *CI policies and gates* that apply to PRs.

Frequently asked questions