cicd-security

Analyze CI/CD pipeline security vulnerabilities across GitHub Actions, CircleCI, Jenkins, and GitLab CI.

3|Updated Jul 6, 2026

Search Tags:#ci/cd #github actions #security scanning #vulnerability detection #pipeline security

One-click install

npx skills add https://github.com/hataiit9x/Bbkit-AI --skill cicd-security-hataiit9x

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: cicd-security
Source: https://github.com/hataiit9x/Bbkit-AI/tree/main/ref/claude-bug-bounty/skills/cicd-security
Command: npx skills add https://github.com/hataiit9x/Bbkit-AI --skill cicd-security-hataiit9x

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sisakulint, trufflehog, gitleaks, gh, nuclei, secrets_hunter.sh, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the security risks in CI/CD pipelines by detecting common vulnerabilities such as workflow injection, secret exfiltration, and self-hosted runner poisoning.

Core Features & Use Cases

CI/CD Security Scanning: Detects common security issues in GitHub Actions workflows.
Vulnerability Analysis: Identifies and analyzes vulnerabilities like secret exposure and code injection.
Use Case: Use this Skill to ensure the security of your CI/CD pipelines, preventing potential breaches in your development workflow.

Quick Start

Run the cicd_scanner.sh script to scan a GitHub repository for CI/CD pipeline vulnerabilities.

Frequently Asked Questions about cicd-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan GitHub Actions workflows for security vulnerabilities like secret exposure and code injection?▼

To scan GitHub Actions workflows for security vulnerabilities, run the cicd_scanner.sh script to detect secret exposure, code injection, and workflow injection. This identifies and analyzes common security risks within your CI/CD pipelines.

What types of CI/CD pipeline vulnerabilities can be detected using security scanning?▼

CI/CD pipeline security scanning detects vulnerabilities such as workflow injection, secret exfiltration, self-hosted runner poisoning, and code injection. This analysis prevents potential breaches by identifying risks in your development workflow.

Can I use this pipeline security analyzer for CI/CD configurations in Jenkins, GitLab CI, and CircleCI?▼

Yes, the pipeline security analyzer is applicable to GitHub Actions, CircleCI, Jenkins, and GitLab CI workflows. It analyzes these configurations to detect common security vulnerabilities like secret exposure and code injection.

Do I need to install gitleaks and trufflehog to detect secret exposure in my CI/CD pipeline?▼

Yes, you need to install dependencies like gitleaks, trufflehog, and sisakulint to detect secret exposure and analyze vulnerabilities. These tools are required for the scanner to perform comprehensive CI/CD pipeline security analysis.

What is the best way to prevent self-hosted runner poisoning in GitHub Actions?▼

To prevent self-hosted runner poisoning in GitHub Actions, use a dedicated security scanner to identify workflow injection and code injection vulnerabilities. This ensures your CI/CD pipelines remain secure against potential breaches.