Guide · Agent skill
How to use the GitLab DevSecOps Pipeline Builder agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This is an agent skill, a folder of instructions and helper files that an AI coding agent such as Claude loads when your request matches its description. The GitLab DevSecOps Pipeline Builder skill (name: building-devsecops-pipeline-with-gitlab-ci) teaches the agent how to write a GitLab CI configuration that runs security scanners on every change. It is for engineers and security teams who already use GitLab and want a starting point for shift-left scanning. After this guide you will know how to install the skill, ask for it in plain language, and review what it produces before using it.
GitLab DevSecOps Pipeline Buildermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Get the ZIP from this page and unzip it. The folder should contain SKILL.md, scripts, references and assets.
- 2Place it in the skills folder. Move the folder to ~/.claude/skills/ for all projects, or to .claude/skills/ in one project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Confirm your prerequisites. Check that you have a GitLab Ultimate license, a GitLab Runner, a container build method and a deployed staging app if you want DAST.
- 4Ask for the pipeline in plain language. Describe your language, deployment target and which scanners you need. The agent will load the skill when your request matches it.
- 5Review the generated .gitlab-ci.yml. Replace placeholder URLs and deployment names, and confirm each job, especially deploy steps and kubectl commands.
- 6Test on a branch. Commit the file to a non-default branch and check the pipeline run and the Vulnerability Report before merging.
What the skill makes the agent do
Once installed, the agent can write a .gitlab-ci.yml file that includes GitLab's built-in security scanners. The skill's source covers static application security testing (SAST) with analyzers such as Semgrep, SpotBugs, Gosec, Bandit and NodeJsScan, dynamic testing (DAST) against a deployed staging app, container scanning, dependency scanning, and secret detection, all pulled in through GitLab's managed security templates.
The skill also explains how to set up scan execution and merge request approval policies, and where findings appear in GitLab's Vulnerability Report. Its bundled scripts can generate a pipeline template and query the GitLab API to compile scan results across projects into a report.
Install the skill from the ZIP download
Download the ZIP for this skill from this page and unzip it. To make it available to Claude Code for all your projects, place the unzipped folder in ~/.claude/skills/. To limit it to one project, place it in that project's .claude/skills/ folder.
If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.
- Personal (all projects): ~/.claude/skills/
- Single project: .claude/skills/ inside the project folder
- Claude apps: Settings → Capabilities → Skills
Trigger the skill with a natural request
You do not need a special command. The agent loads the skill when your request matches its description, which covers building a shift-left DevSecOps pipeline in GitLab, adding vulnerability scanning stages to .gitlab-ci.yml, or triaging scanner findings with GitLab Duo AI before deployment.
Be specific about your project. Mention your language, your deployment target and whether you want DAST, because the skill's example depends on a staging URL.
- Add SAST and secret detection to the .gitlab-ci.yml in this Node.js repo.
- Build a shift-left security stage for a GitLab project that deploys to Kubernetes.
- Write a script that compiles security scan results across my GitLab projects into a report.
What you need before you start
The source lists these prerequisites. Check them before relying on the output.
- GitLab Ultimate license, which the skill says is required for the full scanner suite
- GitLab Runner, shared or self-hosted
- Docker-in-Docker or Kaniko for container builds
- Python 3 with the requests library, for scripts/agent.py
- A GitLab API token with access to the target projects, for scripts/process.py
- A deployed staging environment for DAST
Review the generated pipeline before you run it
The example pipeline in the skill includes automatic deploy jobs and kubectl commands that target placeholder names such as a staging.example.com URL and a deployment called app. Replace these with your own environment details. The production deploy job is set to manual, but you should still read every job before merging.
The source does not state that the scripts or pipeline example have been tested against a live GitLab instance, so treat them as a template to verify, not a finished tool.
- Replace placeholder URLs, namespaces and deployment names.
- Check kubectl commands against your cluster setup.
- Run the pipeline on a non-production branch first.
Safety notes: scripts and network access
This skill runs scripts and uses the network. scripts/process.py queries the GitLab API using your token, so use a token scoped to only the projects you need and do not paste it into prompts or committed files. Read the scripts before running them in an environment that holds production credentials.
What people use it for
- Adding SAST, secret detection and dependency scanning to an existing GitLab project's pipeline.
- Setting up a security stage that runs before a staging deploy, with DAST against the staging URL.
- Drafting a scan execution policy and merge request approval policy for a team's GitLab group.
- Writing a script that gathers security scan results across several GitLab projects into one report.
Frequently asked questions
How do I install the building-devsecops-pipeline-with-gitlab-ci skill?
Download the ZIP from this page and unzip it. Put the folder in ~/.claude/skills/ for all your projects, or in a project's .claude/skills/ folder for one project. In the Claude apps, you can upload it under Settings → Capabilities → Skills.
Does this GitLab security scanning skill require a paid license?
Yes, according to the skill's prerequisites. It lists a GitLab Ultimate license as required for the full security scanner suite. The source does not describe a free tier for these scanners.
What do I need to run this GitLab DevSecOps pipeline?
You need a GitLab Runner, Docker-in-Docker or Kaniko for container builds, a deployed staging environment for DAST, and a .gitlab-ci.yml file. The helper scripts need Python 3 with the requests library and a GitLab API token.
Which scanners does the skill include?
The skill covers SAST with Semgrep, SpotBugs, Gosec, Bandit and NodeJsScan, plus DAST, container scanning with Trivy, dependency scanning, secret detection and license scanning, all through GitLab's managed templates.
Are there alternatives if I'm not on GitLab?
The source only describes GitLab's managed templates and features, so it does not compare this skill to other tools. Teams not on GitLab would need a different CI platform and its own scanner setup.
Why does my generated pipeline fail or do the wrong thing?
The source does not say the example was tested against a live GitLab instance. Check placeholder URLs, deployment names, runner availability and your API token scope, then run the pipeline on a non-default branch to find the problem.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you run GitLab with an Ultimate license and want a reviewable starting point for security scanning in .gitlab-ci.yml, plus a cross-project report script. Pick something else if you are not on GitLab, lack the license, or need a pipeline you can run against production without reading and adapting it first.
Download the skill