Skip to main content
affpapa.org
RU EN
skill CX Codex

agentic-sdlc-controls — Claude Code skill: what it does and setup

Audits development pipelines where AI agents commit, run tests, or deploy code. It maps credentials and defines hard boundaries for irreversible actions.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add securityskills/skills --skill agentic-sdlc-controls -a claude-code
Open on GitHub

What agentic-sdlc-controls does

An autonomous coding agent executes work at machine speed using the credentials given to it. This skill focuses on hard system boundaries rather than model alignment. The process starts by cataloging agent reach: service account identity, repository permissions, reachable staging or production environments, runtime secrets, and outbound network traffic.

Actions split strictly by reversibility. Modifying source files or running test suites can proceed autonomously. Schema migrations, publishing packages, and branch merges require mandatory human approvals. Operations like data deletion or credential rotation stay completely out of reach. Prompts alone cannot stop bad behavior. Runtime hooks and immutable guardrails must enforce every boundary.

The review also checks how the pipeline handles untrusted data. External issue text, pull request summaries, or documentation can carry hidden instructions. Teams needing audit-ready evidence can combine this review with the ai-change-evidence skill.

What it helps with

  • Catalog all credentials, environments, and network paths reachable by an agent
  • Separate safe reversible tasks from operations requiring human sign-off
  • Block autonomous agents from executing destructive or irreversible commands
  • Identify prompt injection paths across issue descriptions and external docs

Example prompts for the agent

  • Audit our CI/CD pipeline permissions using agentic-sdlc-controls
  • Check which actions our coding agent can run without human approval
  • Map all runtime secrets exposed to the agent and recommend tighter scopes

How to install agentic-sdlc-controls

1Skills CLI (Vercel)

npx skills add securityskills/skills --skill agentic-sdlc-controls -a claude-code

2Manually: put the files in place

~/.claude/skills/agentic-sdlc-controls/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/agentic-sdlc-controls/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about agentic-sdlc-controls

How to install agentic-sdlc-controls in Claude Code?

Run npx skills add securityskills/skills --skill agentic-sdlc-controls -a claude-code. The skill definition will be stored at ~/.claude/skills/agentic-sdlc-controls/SKILL.md.

What does agentic-sdlc-controls do?

It provides a structured security audit for pipelines where AI agents write and deploy code. The review covers permission boundaries, credential exposure, and approval gates for irreversible actions.

Why does the skill insist on runtime enforcement over prompt instructions?

Prompts act as preferences that a confused or manipulated model can ignore. Runtime mechanisms like pre-action hooks and platform permission lists enforce hard boundaries that the agent cannot modify or bypass.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set6

stride-threat-modeling Run a structured STRIDE threat modeling workshop during system design. The skill maps trust boundaries, catalogs attack vectors per component, and generates backlog tickets. CX Codex +1 2,700installs jwt-security-review Audits JWT implementations for key confusion, weak secrets, and token lifecycle flaws. Handy when checking API authorization code. CX Codex +1 1,500installs network-segmentation-review Inspects traffic boundaries across local networks, firewalls, and cloud environments. It helps engineers spot routing leaks and test zone isolation. CX Codex +1 584installs pci-dss-scoping Walks an agent through PCI DSS scoping: cardholder data flows, segmentation checks and a v4.0 requirements matrix. Built for audit prep. CX Codex +1 414installs ai-change-evidence Builds an auditor-ready record for changes written by coding agents: who asked, what was requested, who approved. Useful when that code sits under SOC 2, ISO 27001 or PCI DSS. CX Codex +1 334installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor