skills.rest
0xhaaz
0xhaazCOMMUNITY
Explore all skills by this author →
𝕏@0xhaazGitHub

cicd-security

Scan CI/CD pipelines for security vulnerabilities using sisakulint.

1|Updated Jun 22, 2026
Search Tags:#ci/cd#security#vulnerability#github actions#pipeline
One-click install
npx skills add https://github.com/0xhaaz/bug-bounty-toolkit --skill cicd-security-0xhaaz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cicd-security
Source: https://github.com/0xhaaz/bug-bounty-toolkit/tree/main/skills/cicd-security
Command: npx skills add https://github.com/0xhaaz/bug-bounty-toolkit --skill cicd-security-0xhaaz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sisakulint, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and mitigates security vulnerabilities in CI/CD pipelines, such as workflow injection, secret exfiltration, and supply chain attacks.

Core Features & Use Cases

  • CI/CD Security Scanning: Identifies common security issues in GitHub Actions workflows.
  • Vulnerability Detection: Detects script injection, secret exposure, and other security risks.
  • Use Case: Use this Skill to ensure the security of your CI/CD pipelines by scanning for vulnerabilities and applying remediation steps.

Quick Start

Run the cicd_scanner.sh script to scan your GitHub Actions workflows for security issues.

Frequently Asked Questions about cicd-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan GitHub Actions workflows for security vulnerabilities?▼

Scanning GitHub Actions workflows for security vulnerabilities involves running the cicd_scanner.sh script. It identifies script injection, secret exposure, and supply chain risks to secure your CI/CD pipelines.

What is workflow injection in CI/CD pipelines?▼

Workflow injection in CI/CD pipelines is a security vulnerability where untrusted input is executed within workflow scripts. This Skill detects such script injection risks alongside secret exfiltration and supply chain attacks.

Does this CI/CD security scanner work with Jenkins and GitLab CI?▼

Yes, this CI/CD security scanner applies to organizations using Jenkins and GitLab CI, as well as GitHub Actions and CircleCI. It identifies and mitigates vulnerabilities across these pipeline platforms.

Do I need sisakulint to detect secret exfiltration in pipelines?▼

Yes, you need sisakulint installed for scanning and analysis. The Skill requires this dependency to identify secret exfiltration, workflow injection, and supply chain attacks in your CI/CD pipelines.

What's the best way to prevent supply chain attacks in CI/CD?▼

Preventing supply chain attacks in CI/CD requires comprehensive security scanning to identify and mitigate vulnerabilities. This Skill scans your pipelines to detect injection risks and applies remediation steps.

What types of security risks are detected during CI/CD pipeline scanning?▼

CI/CD pipeline scanning detects security risks including script injection, secret exposure, workflow injection, and secret exfiltration. It identifies these vulnerabilities to mitigate potential supply chain attacks.

Related Skills

Explore More Software Engineering Skills→
pantheon-orgpantheon-org
9

github-actions-generator

Generate GitHub Actions workflows and CI/CD configurations with security standards.

Official
Advanced
bpnrockstarbpnrockstar

cicd-security

Identify security vulnerabilities in CI/CD pipelines across GitHub Actions, CircleCI, Jenkins, and GitLab CI.

Community
Advanced
not-subhunot-subhu

security-scan

Orchestrate dependency audits, static application security testing, and privacy dataflow analysis.

Community
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

secure

Scan code, dependencies, and containers for vulnerabilities and generate SBOMs.

Official
Advanced