offensive-cicd-pipeline

offensive-cicd-pipeline is a Penetration testing & red team skill for AI agents, published by SnailSploit in the Claude-Red repository on GitHub. Skillspace rates offensive-cicd-pipeline F (15/100) and the safety scan rated it unsafe; the rating is based on static analysis only.

Unsafe. This skill has patterns associated with malicious or dangerous behaviour. We do not recommend running it.

Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline…

Grade

F

Quality

15 / 100

Safety

Unsafe

GitHub stars

3,959

Unproven: rated by static analysis only, not yet compared head-to-head.

This rating describes the version of the repository we crawled; it may have changed since.

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.