cicd-security

CI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks. Covers sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs into critical findings. Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/cicd-security/SKILL.md

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, token-efficient CI/CD hunting reference whose grep/PoC/report material is copy-paste ready. Its main weaknesses are a lack of explicit validation checkpoints in the workflow (capped at 3) and a monolithic structure with missing referenced bundle files.

Suggestions

Add an explicit validation/verify step to the hunting workflow — e.g. 'Confirm the PoC fires by checking for the DNS/HTTP callback before reporting' — to lift workflow_clarity above the destructive-operation cap of 3.

Split the per-bug-class deep-dives (sections 2–7) and the report template (section 10) into separate reference files under references/ and link to them from SKILL.md, so the overview stays lean.

Provide the referenced bundle files (tools/cicd_scanner.sh, tools/secrets_hunter.sh, install_tools.sh) or remove the references, since none currently exist in scripts/, references/, or assets/.

Dimension	Reasoning	Score
Conciseness	Dense and largely padding-free — grep commands, PoC payloads, and YAML patterns earn their tokens — but the recurring 'What It Is' prose and some explanatory asides (e.g. 'Why It's Critical' bullets) could be trimmed; not a 5 because of those minor over-explanations.	4 / 5
Actionability	Fully executable throughout: concrete `grep -rn` detection commands, copy-paste PoC payloads, vulnerable/safe YAML pairs, a `cicd_scanner.sh` invocation block, and a complete report template covering the common cases.	5 / 5
Workflow Clarity	Sequences exist (Quick Kill Checklist, numbered exploit paths, chaining chains) and a scope/safety note is present, but there are no explicit validation/verification checkpoints in the hunting workflow; because triggering workflows and secret exfiltration are destructive/batch-style operations, the rubric caps workflow_clarity at 3.	3 / 5
Progressive Disclosure	Well-organized into numbered sections, but the file is a ~380-line monolith with bug-class deep-dives, a tools reference table, and a full report template all inlined that could live in separate reference files; the referenced scripts (cicd_scanner.sh, secrets_hunter.sh, install_tools.sh) are not present in any bundle directory.	3 / 5
	Total	15 / 20 Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely enumerates CI/CD attack classes and tools, and carries an explicit 'Use when' trigger covering the major CI platforms. Minor gaps in bug-class coverage and synonyms keep specificity and trigger_term_quality just below the top anchor.

Dimension	Reasoning	Score
Specificity	Lists several specific concrete actions — 'workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft' plus 'sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs' — with only minor gaps in coverage (e.g. artifact poisoning mentioned in body but not description); not a 5 because a few bug classes from the body are omitted.	4 / 5
Completeness	Clearly answers both 'what' (the enumerated CI/CD attack classes and 'sisakulint scanning, manual workflow analysis, chaining... findings') and 'when' via the explicit 'Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI' trigger clause.	5 / 5
Trigger Term Quality	Strong natural keywords — 'GitHub Actions', 'public repos', 'CircleCI', 'Jenkins', 'GitLab CI' — that users would actually say; a few natural synonyms missing (e.g. 'pipeline', 'workflows', 'supply chain' is present) so not a 5.	4 / 5
Distinctiveness Conflict Risk	Clear niche (CI/CD pipeline security hunting) with distinct triggers; mostly distinct from adjacent security skills, with minor overlap risk with a generic 'supply chain' or 'secret scanning' skill, so not a 5.	4 / 5
	Total	17 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: shuvonsec/claude-bug-bounty
Path: skills/cicd-security/SKILL.md
Commit: 0826b13

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.