Verified:GitHub

cicd-security

Identify security vulnerabilities in CI/CD pipelines across GitHub Actions, CircleCI, Jenkins, and GitLab CI.

Updated Jul 1, 2026

Search Tags:#ci/cd #security #github actions #vulnerability detection #workflow security

One-click install

npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill cicd-security-bpnrockstar

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: cicd-security
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/cicd-security
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill cicd-security-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sisakulint, trufflehog, gitleaks, gh, nuclei, secrets_hunter.sh, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the security vulnerabilities in CI/CD pipelines, identifying risks such as workflow injection, secret exfiltration, and supply chain attacks.

Core Features & Use Cases

CI/CD Security Analysis: Identifies security issues like script injection, secret leakage, and unauthorized runner usage.
Vulnerability Detection: Scans for common vulnerabilities like OIDC token theft and dependency confusion.
Use Case: For organizations using GitHub Actions, CircleCI, Jenkins, or GitLab CI, this Skill helps secure their CI/CD pipelines against potential attacks.

Quick Start

Run the cicd_security skill to scan your GitHub Actions workflow for common security issues.

Frequently Asked Questions about cicd-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect workflow injection and secret exfiltration vulnerabilities in GitHub Actions?▼

CI/CD security analysis scans pipelines using tools like sisakulint to identify workflow injection, secret exfiltration, and supply chain attacks. It detects script injection risks, secret leakage, and unauthorized runner usage across your workflows.

Does this CI/CD vulnerability detection work with CircleCI, Jenkins, and GitLab CI workflows?▼

Yes, CI/CD vulnerability detection supports CircleCI, Jenkins, and GitLab CI workflows alongside GitHub Actions. It scans for common vulnerabilities like OIDC token theft, dependency confusion, and unauthorized runner usage across these platforms.

What tools do I need to scan for OIDC token theft and dependency confusion in pipelines?▼

Scanning for OIDC token theft and dependency confusion requires tools like sisakulint for workflow scanning, trufflehog and gitleaks for secret detection, nuclei for vulnerability scanning, and gh for repository access to perform detailed pipeline analysis.

What is the best way to prevent supply chain attacks in CI/CD pipelines?▼

Preventing supply chain attacks in CI/CD pipelines involves scanning workflows with sisakulint and running secret hunters to detect exfiltration risks. This approach identifies unauthorized runner usage, dependency confusion, and script injection vulnerabilities.

Why do I need secrets_hunter.sh for CI/CD security analysis?▼

You need secrets_hunter.sh for CI/CD security analysis because it detects exposed secrets within pipeline configurations and workflow files. Combined with trufflehog and gitleaks, it provides comprehensive secret exfiltration detection across your repositories.