cicd-security

CI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks. Covers sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs into critical findings. Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable commands and PoCs, but it is a long monolithic document that explains some known concepts and lacks both a unified validation-driven workflow and any progressive disclosure into bundled reference files.

Suggestions

Split the report template, tools reference, and per-bug-class PoC details into separate files under references/ and link to them from a leaner SKILL.md overview, and actually bundle the referenced tools/cicd_scanner.sh and tools/secrets_hunter.sh scripts.

Trim the 'What It Is' explanations for well-known CI/CD concepts and remove grep duplication between the Quick Kill Checklist and per-section detection blocks to reduce tokens.

Frame the body as one explicit end-to-end workflow (scan → triage findings → verify exploitability → confirm scope/safety → report) with a validation checkpoint before reporting, so the sequenced process is clear rather than implied.

Dimension	Reasoning	Score
Conciseness	The body is information-dense and tactical, but at ~375 lines it includes several 'What It Is' sections explaining concepts Claude already knows (workflow injection, pull_request_target, OIDC) and some grep overlap with the Quick Kill Checklist, so it could be tightened.	2 / 3
Actionability	Provides fully executable grep detection commands, bash PoC payloads, vulnerable/safe YAML pairs, a bug-class table with CVSS, and a copy-paste report template — concrete and immediately usable.	3 / 3
Workflow Clarity	A Quick Kill Checklist, numbered exploit paths, and 'What to Check' sub-checklists give sequence, but there is no explicit validate→fix→retry feedback loop and the body reads more as a bug-class catalog than one unified sequenced workflow.	2 / 3
Progressive Disclosure	Sections are well-organized into 13 numbered parts, but the document is monolithic (>50 lines) with inline content (report template, tool reference, per-class PoCs) that could be split into reference files, and the referenced tools/ scripts are not bundled.	2 / 3
	Total	9 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, well-triggered, and complete, clearly stating both capabilities and a 'Use when' condition in third-person voice. It is a strong, low-conflict trigger description.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft' plus 'sisakulint scanning' and 'chaining CI/CD bugs' — matching the score-3 anchor of multiple specific concrete actions.	3 / 3
Completeness	Explicitly answers both what it does (the attack classes and scanning/analysis) and when to use it via the 'Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.' clause.	3 / 3
Trigger Term Quality	Includes natural platform terms a user would actually say — 'GitHub Actions, CircleCI, Jenkins, or GitLab CI' and 'public repos' — giving good coverage rather than jargon.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear CI/CD pipeline-security niche with platform-specific triggers, making it unlikely to fire for an unrelated skill.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: shuvonsec/claude-bug-bounty
Path: skills/cicd-security/SKILL.md
Commit: 2009594

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.