# agentic-sdlc-controls

Audits development pipelines where AI agents commit, run tests, or deploy code. It maps credentials and defines hard boundaries for irreversible actions.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 800 installs
- Author: securityskills
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/securityskills/skills/tree/HEAD/agentic-security/pipeline/agentic-sdlc-controls/SKILL.md
- Updated: 2026-08-26
- HTML: https://affpapa.org/en/nevibecode/skills/agentic-sdlc-controls

## What it does

An autonomous coding agent executes work at machine speed using the credentials given to it. This skill focuses on hard system boundaries rather than model alignment. The process starts by cataloging agent reach: service account identity, repository permissions, reachable staging or production environments, runtime secrets, and outbound network traffic.

Actions split strictly by reversibility. Modifying source files or running test suites can proceed autonomously. Schema migrations, publishing packages, and branch merges require mandatory human approvals. Operations like data deletion or credential rotation stay completely out of reach. Prompts alone cannot stop bad behavior. Runtime hooks and immutable guardrails must enforce every boundary.

The review also checks how the pipeline handles untrusted data. External issue text, pull request summaries, or documentation can carry hidden instructions. Teams needing audit-ready evidence can combine this review with the `ai-change-evidence` skill.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill agentic-sdlc-controls -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/agentic-sdlc-controls/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/agentic-sdlc-controls/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill agentic-sdlc-controls -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/agentic-sdlc-controls/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill agentic-sdlc-controls -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/agentic-sdlc-controls/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install securityskills/skills agentic-sdlc-controls
```

2. **Manually: put the files in place**
- File: `.github/skills/agentic-sdlc-controls/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill agentic-sdlc-controls -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/securityskills/skills --path agentic-security/pipeline/agentic-sdlc-controls
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/agentic-sdlc-controls/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill agentic-sdlc-controls -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/securityskills/skills/tree/HEAD/agentic-security/pipeline/agentic-sdlc-controls/SKILL.md

## When to use it
- Catalog all credentials, environments, and network paths reachable by an agent
- Separate safe reversible tasks from operations requiring human sign-off
- Block autonomous agents from executing destructive or irreversible commands
- Identify prompt injection paths across issue descriptions and external docs

## Example prompts
- Audit our CI/CD pipeline permissions using agentic-sdlc-controls
- Check which actions our coding agent can run without human approval
- Map all runtime secrets exposed to the agent and recommend tighter scopes

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [securityskills/skills](https://affpapa.org/en/nevibecode/by/securityskills/skills.md) — 6 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md