cicd-security

Name: cicd-security
Availability: InStock
Author: 0xHaaz

Scan CI/CD pipelines for security vulnerabilities using sisakulint.

1|Updated Jun 22, 2026

Search Tags:#ci/cd #security #vulnerability #github actions #pipeline

Ready to run

npx skills add https://github.com/0xhaaz/bug-bounty-toolkit --skill cicd-security-0xhaaz

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cicd-security
Source: https://github.com/0xhaaz/bug-bounty-toolkit/tree/main/skills/cicd-security
Command: npx skills add https://github.com/0xhaaz/bug-bounty-toolkit --skill cicd-security-0xhaaz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sisakulint, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and mitigates security vulnerabilities in CI/CD pipelines, such as workflow injection, secret exfiltration, and supply chain attacks.

Core Features & Use Cases

CI/CD Security Scanning: Identifies common security issues in GitHub Actions workflows.
Vulnerability Detection: Detects script injection, secret exposure, and other security risks.
Use Case: Use this Skill to ensure the security of your CI/CD pipelines by scanning for vulnerabilities and applying remediation steps.

Quick Start

Run the cicd_scanner.sh script to scan your GitHub Actions workflows for security issues.

Frequently Asked Questions about cicd-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan GitHub Actions workflows for security vulnerabilities?▼

Scanning GitHub Actions workflows for security vulnerabilities involves running the cicd_scanner.sh script. It identifies script injection, secret exposure, and supply chain risks to secure your CI/CD pipelines.

What is workflow injection in CI/CD pipelines?▼

Workflow injection in CI/CD pipelines is a security vulnerability where untrusted input is executed within workflow scripts. This Skill detects such script injection risks alongside secret exfiltration and supply chain attacks.

Does this CI/CD security scanner work with Jenkins and GitLab CI?▼

Yes, this CI/CD security scanner applies to organizations using Jenkins and GitLab CI, as well as GitHub Actions and CircleCI. It identifies and mitigates vulnerabilities across these pipeline platforms.

Do I need sisakulint to detect secret exfiltration in pipelines?▼

Yes, you need sisakulint installed for scanning and analysis. The Skill requires this dependency to identify secret exfiltration, workflow injection, and supply chain attacks in your CI/CD pipelines.

What's the best way to prevent supply chain attacks in CI/CD?▼

Preventing supply chain attacks in CI/CD requires comprehensive security scanning to identify and mitigate vulnerabilities. This Skill scans your pipelines to detect injection risks and applies remediation steps.

What types of security risks are detected during CI/CD pipeline scanning?▼

CI/CD pipeline scanning detects security risks including script injection, secret exposure, workflow injection, and secret exfiltration. It identifies these vulnerabilities to mitigate potential supply chain attacks.