Testing & Security Skills

Debug live Buildkite builds and stay accurate using the Buildkite MCP server and real-time documentation search. Use when investigating why a build/step failed, fetching build logs or annotations, listing pipelines/builds/agents, or when you need to verify current Buildkite syntax/behavior against the live docs. Triggers on "why did my build fail", "Buildkite logs", "debug the pipeline", or "check the latest Buildkite docs".

Scaffold a brand-new Buildkite plugin repository from scratch with a correct directory layout, plugin.yml, executable hooks, Bats tests, a docker-compose test harness, and a CI pipeline. Use when a developer says "create/start/ bootstrap a new Buildkite plugin", "scaffold a plugin", or needs the initial plugin file structure generated for them.

Build, structure, and debug custom Buildkite plugins — Bash hook plugins, Docker/docker-compose plugins, and compiled (Go) binary plugins with a downloader-shim hook. Use when writing a plugin.yml, implementing agent lifecycle hooks (environment, checkout, command, pre-exit, etc.), mapping YAML plugin config to BUILDKITEPLUGIN environment variables, releasing plugin binaries with GoReleaser, or scaffolding a new Buildkite plugin repository. Triggers on "Buildkite plugin", "plugin.yml", "plugin hooks", or "BUILDKITEPLUGIN".

Security review and vulnerability scanning for Buildkite plugins (Bash, Docker, Go). Use when auditing or hardening a plugin, reviewing plugin code for vulnerabilities before release, or answering "is this plugin secure?". Checks command/argument injection, secret leakage, unsafe eval, missing quoting, supply-chain (unpinned images/deps, unverified downloads, curl|bash), privilege (privileged containers, Docker socket, root), untrusted plugin config input, and TLS/integrity. Runs an executable scanner plus shellcheck, hadolint, gitleaks, gosec, govulncheck, and trivy when available.

Test, lint, and set up CI for Buildkite plugins using Bats, the buildkite/plugin-tester image, the buildkite/plugin-linter, and shellcheck. Use when writing or fixing .bats tests for plugin hooks, stubbing commands like docker/git in tests, validating plugin.yml, or creating the plugin's own .buildkite/pipeline.yml CI. Triggers on "bats", "plugin-tester", "plugin-linter", or "test a Buildkite plugin".

Design, set up, and validate Buildkite pipelines. Use when writing or reviewing a .buildkite/pipeline.yml, building dynamic pipelines that upload steps at runtime, structuring step DAGs with dependson/key, using matrix builds, group/wait/block/input/trigger steps, retries, softfail, concurrency, parallelism, conditionals, or agent queue targeting. Also covers validating pipelines with buildkite-agent pipeline upload --dry-run. Triggers on "Buildkite pipeline", "pipeline.yml", "dynamic pipeline", or "pipeline steps".

Security review, hardening, and vulnerability scanning for Buildkite pipelines and self-hosted agents (CI/CD). Use when auditing a .buildkite/pipeline.yml or agent setup, hardening CI/CD, or answering "is this pipeline/agent secure?". Covers secrets in YAML, OIDC vs static creds, plugin pinning & RCE, untrusted fork/PR builds, agent hooks as security controls (pre-bootstrap job rejection, allowed-plugins, no-command-eval, no-local-hooks, signed pipelines), Docker socket/privileged steps, queue/cluster isolation, and injection via build metadata. Runs an executable scanner plus gitleaks when available.