agentsclimarketplace
Sign in

Cicd supply chain

Skill hypnguyen1209/offensive-claude/skills/cicd-supply-chain

Use when attacking or auditing a CI/CD pipeline or software supply chain — pwn requests, poisoned pipeline execution, compromised/mutable-tag actions, dependency confusion, registry worms, runner backdoors, OIDC trust abuse, SLSA/provenanceFrom its SKILL.md

Install
npx -y skills add hypnguyen1209/offensive-claude --skill cicd-supply-chain

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • reads credentialsReads from 1 credential source: `$GH_TOKEN`.
  • runs commandsInstructs the agent to run 8 commands, including `gh repo list ORG --limit 1000 --json nameWithOwner -q '.[].nameWithOwner' > repos.txt` and 7 more.

SKILL.md

9.2 KB, ~2.0k tokens by cl100k_base, as published. Nobody here has run it

CI/CD Pipeline Poisoning & Supply-Chain Attacks

When to Activate

  • Auditing or attacking GitHub Actions / GitLab CI / Jenkins pipelines for code execution
  • Hunting pull_request_target / workflow_run "pwn requests" and Poisoned Pipeline Execution (PPE)
  • Assessing compromised third-party Actions, mutable version tags, and Actions cache poisoning
  • Dependency confusion, typo/slopsquatting, and malicious package/install-hook payloads
  • Self-hosted / non-ephemeral runner abuse and runner backdoors
  • CI secret exfiltration and OIDC cloud-role (AWS/GCP/Azure) trust-policy abuse
  • Validating SLSA build provenance and signing gates (defense / blue-team validation)

Technique Map

TechniqueATT&CKCWEReferenceScript
Pwn request (pull_request_target checkout of fork head)T1195.001CWE-269references/pipeline-poisoning.mdscripts/workflow_auditor.py
Script injection (${{ github.event.* }} into run:)T1059CWE-94references/pipeline-poisoning.mdscripts/workflow_auditor.py
Direct / Indirect PPE (workflow or build-file modification)T1195.001CWE-913references/pipeline-poisoning.mdscripts/workflow_auditor.py
GitLab .gitlab-ci.yml poisoning / pipeline-as-user (CVE-2024-6678)T1648CWE-863references/pipeline-poisoning.mdscripts/workflow_auditor.py
Compromised Action via mutable tag (CVE-2025-30066 tj-actions)T1195.001CWE-494references/action-dependency-compromise.mdscripts/malicious_action_scanner.py
Transitive Action compromise (CVE-2025-30154 reviewdog)T1195.001CWE-1357references/action-dependency-compromise.mdscripts/malicious_action_scanner.py
Actions cache poisoning (cross-workflow escalation)T1525CWE-349references/action-dependency-compromise.mdscripts/malicious_action_scanner.py
Dependency confusion (internal name on public registry)T1195.002CWE-427references/package-registry-attacks.mdscripts/dependency_confusion.py
Typo / slopsquatting + malicious install hookT1195.002CWE-829references/package-registry-attacks.mdscripts/dependency_confusion.py
Self-replicating registry worm (Shai-Hulud npm)T1195.002CWE-829references/package-registry-attacks.mdscripts/malicious_action_scanner.py
Self-hosted / non-ephemeral runner abuse & backdoorT1199CWE-668references/runner-attacks.mdscripts/runner_recon.sh
Jenkins Script Console RCE (/script, CVE-2024-23897)T1648CWE-306references/runner-attacks.mdscripts/runner_recon.sh
CI secret exfiltration (toJSON(secrets), GhostAction)T1552.004CWE-522references/secrets-oidc-abuse.mdscripts/oidc_trust_auditor.py
OIDC trust-policy abuse (missing/* sub, wrong org wildcard)T1078.004CWE-1390references/secrets-oidc-abuse.mdscripts/oidc_trust_auditor.py
Build provenance / signing gate validation (defense)T1195CWE-347references/build-integrity-defense.mdscripts/provenance_verify.sh

Quick Start

# 0. Recon: enumerate workflows, triggers, used actions across an org (read-only token)
gh repo list ORG --limit 1000 --json nameWithOwner -q '.[].nameWithOwner' > repos.txt
python3 scripts/workflow_auditor.py --repos repos.txt --token "$GH_TOKEN" --out findings.json

# 1. Static audit any cloned repo for pwn-requests + injection sinks (offline, no token)
git clone https://github.com/ORG/REPO && python3 scripts/workflow_auditor.py --path REPO

# 2. Flag risky/mutable third-party Action refs (unpinned tags = supply-chain exposure)
python3 scripts/malicious_action_scanner.py --path REPO --check-pins --check-known-bad

# 3. Dependency confusion: find internal names not registered on public registries
python3 scripts/dependency_confusion.py --manifest REPO/package.json --registry npm
python3 scripts/dependency_confusion.py --manifest REPO/requirements.txt --registry pypi

# 4. OIDC abuse: audit AWS IAM trust policies tied to GitHub's OIDC provider
python3 scripts/oidc_trust_auditor.py --provider github --cloud aws --profile target

# 5. Runner recon (run ON a compromised self-hosted runner during an engagement)
bash scripts/runner_recon.sh

# 6. Defensive validation: verify SLSA provenance + cosign signature before promote
bash scripts/provenance_verify.sh --image ghcr.io/org/app:tag --repo org/app

Recommended OSS tooling: gato-x (offensive GHA enumeration/PPE), zizmor/octoscan/poutine/raven (static workflow analysis), step-security/harden-runner (egress control), cosign+slsa-verifier (gates).

OPSEC & Detection (summary)

TechniqueTelemetry / IOCDetection (Sigma/EDR)OPSEC note
Pwn request / PPEFork PR triggering privileged run; new .github/workflows/* in PR; outbound to non-allowlisted hostGH audit log workflows; Sigma on runner egress to new domains; zizmor in CIPayload runs in build log; public-repo logs are world-readable — assume detection
Compromised Action / mutable tagAction ref resolves to new SHA; tag force-push event; base64 in action sourceDiff resolved SHA vs lockfile; alert on tag re-point in audit logTag re-point is logged org-side; SHA-pin victims are immune
Cache poisoningCache key written by read-only/low-priv job, restored by release jobMonitor actions/cache save/restore key ownership; provenance mismatchSurvives across workflows; harder to attribute than direct edit
Dependency confusionInstall-time outbound from build host; package version anomaly (very high ver)EDR proc-tree npm/pip -> curl/node -e; registry telemetryHigher public version wins resolver; noisy if scoped registries enforced
Registry worm (Shai-Hulud)bundle.js postinstall; trufflehog filesystem /; public Shai-Hulud repo; shai-hulud-workflow.ymlEDR: npm child spawns trufflehog/git push; Sigma on workflow file creationSelf-propagating = loud and fast; burns the maintainer token
Runner backdoorRogue runner registration; persistent proc on host; outbound only to github.comRunner-host EDR; GH audit self_hosted_runner events; one-job-per-runnerTraffic blends with github.com; non-ephemeral = persistence
Secret exfil / toJSON(secrets)${{ toJSON(secrets) }} in run step; POST of base64 to webhookStatic scan for toJSON(secrets); egress allowlistGitHub masks *** in logs — encoding evades the mask
OIDC trust abuseAssumeRoleWithWebIdentity; CloudTrail userName = repo:org/repo:refCloudTrail filter on federated principals; IAM Access Analyzer external findingsShort-lived creds, attributed to repo in logs; AWS blocks new bad policies (Jun 2025)

Deep Dives

  • references/pipeline-poisoning.md — Pwn requests, PPE (direct/indirect), script injection, GitLab/Jenkins pipeline poisoning, with vulnerable+fixed YAML and a working exploit PR payload.
  • references/action-dependency-compromise.md — Third-party Action compromise, mutable git tags, the tj-actions (CVE-2025-30066) / reviewdog (CVE-2025-30154) chain, and Actions cache poisoning; SHA-pinning detection.
  • references/package-registry-attacks.md — Dependency confusion, typo/slopsquatting, malicious install hooks, and the Shai-Hulud self-replicating npm worm with concrete IOCs.
  • references/runner-attacks.md — Self-hosted / non-ephemeral runner abuse, JIT/ephemeral hardening, runner backdoors, and Jenkins Script Console RCE.
  • references/secrets-oidc-abuse.md — CI secret enumeration/exfiltration (GhostAction), toJSON(secrets), and AWS/GCP/Azure OIDC trust-policy misconfigurations.
  • references/build-integrity-defense.md — SLSA provenance, in-toto attestations, Sigstore/cosign keyless signing, slsa-verifier gates, and admission-control enforcement (the defensive counterweight).

What ships with it: 12 files

87.1 KB alongside SKILL.md, 6 of them executable

references/

scripts/

Gives 0 of the 12 instructions most ci cd skills give in ~2.0k tokens

Counted across 343 of the 355 authors here whose files we hold, read 2026-09-06

  • Pin third-party actions to full commit SHAin 34 of 343, across 29 files
  • Set timeout-minutes on every jobin 23 of 343, across 17 files
  • Deploy to staging before productionin 18 of 343
  • Use OIDC instead of stored cloud credentialsin 18 of 343, across 12 files
  • Pin action versionsin 14 of 343, across 13 files
  • Cache dependencies keyed on the lockfile hashin 14 of 343, across 13 files
  • Declare least-privilege permissions at workflow and job levelin 13 of 343, across 7 files
  • Pass untrusted values through env variablesin 13 of 343, across 9 files
  • Create efficient GitHub Actions workflowsin 11 of 343, across 5 files
  • Cache dependencies via setup actions or actions/cachein 11 of 343, across 5 files
  • Cache dependencies to speed up buildsin 11 of 343
  • Store secrets in secret managersin 11 of 343, across 10 files

Said here and by no other author read

  • Enumerate org workflows, triggers, and used actions first
  • Statically audit repos for pwn requests and injection sinks
  • Check internal package names against public registries
  • Audit cloud OIDC trust policies for wildcard subjects
  • Run runner recon only on compromised self-hosted runners
  • Assume public build logs expose the payload

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.