Is Build YAML Misconfiguration safe and trustworthy?

tashan scores Build YAML Misconfiguration on public evidence — see the measured signals. Audit scope: OSV advisories, install-time scripts, build provenance and declared permission surface. We do not review source code or execute the capability.

How do I install Build YAML Misconfiguration?

Drop the skill folder into ~/.claude/skills/ (user scope) or .claude/skills/ (project scope).

Who maintains Build YAML Misconfiguration?

source: RedHatProductSecurity/prodsec-skills.

‹ The Index

Build YAML Misconfiguration

skill

Apply when reviewing or writing GitLab CI (.gitlab-ci.yml), Tekton pipeline/task YAML, or Containerfiles/Dockerfiles used in CI builds. Detects common misconfigurations that expose secrets, weaken isolation, skip security gates, grant excessive privileges, or produce insecure container images.

Works with: Claude Code (native) · Cursor, Codex CLI (manual)
native: this artifact type is that client's own format

Category: Dev Tools & CI — see all ranked ›

Install (Claude Code):

cp -r build-yaml-misconfiguration ~/.claude/skills/

Adoption: 1 repos

Security audit

Not scanned yet. We audit npm-published capabilities for known advisories, install-time scripts and permission surface; this one has no npm package we can resolve, or has not reached the queue.

source ↗ · skill:RedHatProductSecurity/build-yaml-misconfiguration

Already running this? npx tashan-cli doctor checks your whole config against the Index — how it works ›

Measured 2026-08-05 · scorer s5 · how · something wrong here?