Your CI is code that runs with your secrets and publishes what your users install. Cloudflare's open-source security-audit skill includes a SUPPLY-CHAIN-AND-RELEASE.md reference whose core rules are useful questions to ask your own pipeline, even without running a full review:

A known-vulnerable or mutable dependency is not a finding by itself. Ask who can influence resolution and what the build does next.

Follow integrity across every handoff, from source to the artifact a user runs.

CI configuration is authorization code: which event triggered it, whose code runs, which secrets exist, what can it publish?

A checksum fetched from the same untrusted place as the artifact proves nothing independent.

I work on free-pi, a free terminal agent that bundles the skill's audit method and reference checklists. It runs them in a single agent, without sub-agents or an OS sandbox, so check every claim the agent makes yourself. This guide is illustrative, not a recorded run.…