hunt-cicd

Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terraform state file leakage, artifact/log secret leakage, pipeline env-var disclosure. Use when target has a public GitHub/GitLab org, exposed CI dashboards (Jenkins/TeamCity/Drone/Argo), or build artifacts/images are reachable.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An executable, well-sequenced offensive CI/CD playbook with strong validation discipline and copy-paste payloads; its main gap is that all material lives inline in one long file with no external reference split-out, slightly limiting progressive disclosure.

Suggestions

Move the per-CVE/exploit deep-dive material (e.g., the Groovy credential-store dump, the CVE-2024-23897 chain details) into a references/ file and link to it from the body to shorten SKILL.md.

Pull the Chain Table and Validation Discipline into a separate reference so the top-level file reads as an overview pointing one level deep.

Dimension	Reasoning	Score
Conciseness	The body is dense and almost entirely action-oriented with minimal concept re-explanation, though a few brief justifying asides ("the X-Jenkins header leaks the exact version") and the inline CVE prose could be trimmed slightly.	4 / 5
Actionability	Provides fully executable, copy-paste-ready commands and payloads across all phases (curl fingerprinting, Groovy credential dump, CVE-2024-23897 @-file expansion, PR-title injection strings, OIDC role inspection) covering the common cases.	5 / 5
Workflow Clarity	Sequences work into Phases 1–6 after an upfront proof-gate, and closes with a per-finding Validation Discipline plus a false-positive retraction checklist, giving explicit checkpoints and a validate→retract feedback loop for risky/outward operations.	5 / 5
Progressive Disclosure	No bundle files exist (references/, scripts/, assets/ absent), so the ~260-line skill is a single well-sectioned document with clear headers and no nested references; it is appropriately organized but everything is inlined rather than split into one-level-deep reference files.	4 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-targeted description that concretely lists capabilities and gives an explicit Use-when trigger scoped to recognizable CI/CD surface indicators. Its only weakness is a jargon-heavy register that slightly limits natural-language trigger matching.

Suggestions

Soften a few jargon phrases with user-natural synonyms (e.g., "CI/CD pipelines", "build pipelines") so non-specialist phrasings also match.

Keep the concrete enumeration but consider trimming the parenthetical technical detail to reduce token weight without losing trigger coverage.

Dimension	Reasoning	Score
Specificity	Enumerates many concrete, distinct vulnerability hunts (workflow injection, runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE, CVE-2024-23897 file read, runner-token registration, Terraform state leakage, env-var disclosure), giving comprehensive coverage of specific capabilities.	5 / 5
Completeness	Explicitly answers "what" via the enumerated hunts and "when" via a concrete "Use when target has a public GitHub/GitLab org, exposed CI dashboards..., or build artifacts/images are reachable" trigger clause.	5 / 5
Trigger Term Quality	Includes natural niche terms users would say ("CI/CD", "GitHub", "GitLab", "Jenkins", "CI dashboards", "build artifacts") plus product names, though the phrasing leans technical/jargon-heavy with a few natural variations absent.	4 / 5
Distinctiveness Conflict Risk	Targets a clearly distinct niche (CI/CD pipeline security) with named systems and specific finding classes, making it unlikely to trigger for unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-cicd/SKILL.md
Commit: a3ea443

Reviewed: ~21 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.