cicd-security

★ 8.1 · general

cicd-security is a Claude Code skill that hunts for vulnerabilities across CI/CD pipelines — covering GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, OIDC token theft, dependency confusion, and supply chain attacks. It combines automated scanning via cicd_scanner.sh (supporting org-wide scans of up to 50 repos and recursive reusable workflow analysis) with manual review of injectable contexts such as github.event.pull_request.title, github.head_ref, and github.event.comment.body. Critical attack paths include pull_request_target misuse that exposes org secrets to untrusted fork code, overly permissive GITHUB_TOKEN with contents:write or packages:write, and public repos running jobs on self-hosted runners. Use this skill when a target has GitHub Actions, CircleCI, Jenkins, or GitLab CI and the goal is to chain pipeline bugs into code execution on the build server or backdoored production releases.