hunt-cicd

Detect critical CI/CD pipeline vulnerabilities across GitHub Actions, GitLab CI, Jenkins, and Terraform.

1.1k|191|Updated Jun 24, 2026

Search Tags:#github actions #terraform #jenkins #ci/cd security #red team #secret exfiltration #pipeline vulnerabilities

One-click install

npx skills add https://github.com/uphiago/recon-skills --skill hunt-cicd

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: hunt-cicd
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-cicd
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-cicd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CI/CD pipelines are high-value attack surfaces that are frequently overlooked during security assessments, leading to unpatched critical vulnerabilities that can result in full infrastructure or cloud account compromise.

Core Features & Use Cases

Multi-platform CI/CD vulnerability detection: Identifies critical flaws across GitHub Actions, GitLab CI, Jenkins, and Terraform deployments, including Pwnrequest injection, Jenkins script console RCE, self-hosted runner poisoning, OIDC trust policy abuse, runner token abuse, Terraform state leakage, and build artifact secret leaks.
Field-validated exploitation guidance: Provides proven, real-world exploitation payloads and validation methods for 18+ high-severity vulnerability classes sourced from HackerOne, GitHub Security Lab, and PortSwigger research.
Use Case: For penetration testers and red teamers assessing organizations with public GitHub/GitLab repositories, exposed CI dashboards, or publicly reachable build artifacts, this skill eliminates false positives with explicit validation gates and impact proof requirements.

Quick Start

Use the hunt-cicd skill to identify and validate critical CI/CD pipeline vulnerabilities in a target organization's public GitHub repositories and exposed Jenkins instances.

Frequently Asked Questions about hunt-cicd

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find CI/CD pipeline vulnerabilities in GitHub Actions and Jenkins?▼

Identifying CI/CD pipeline vulnerabilities requires detecting flaws like Pwnrequest injection in GitHub Actions and Jenkins script console RCE. You must hunt for secret exfiltration, runner poisoning, and cloud privilege escalation across exposed build infrastructure and public repositories.

What are common CI/CD security flaws in Terraform deployments?▼

Common CI/CD security flaws in Terraform deployments include Terraform state file leakage and OIDC trust policy abuse. Exploiting these pipeline vulnerabilities allows attackers to extract backend credentials and achieve cloud privilege escalation via publicly accessible infrastructure configurations.

How do I validate CI/CD pipeline injection exploits without false positives?▼

Validating CI/CD pipeline injection exploits without false positives requires applying explicit validation gates and impact proof requirements. Use field-validated exploitation payloads and false positive filters to confirm high-severity classes like runner token abuse and self-hosted runner poisoning.

Can I use CI/CD vulnerability detection for red team engagements on public repositories?▼

You can use CI/CD vulnerability detection for red team engagements targeting organizations with public GitHub or GitLab repositories. It identifies exposed build artifacts, self-hosted runner poisoning, and pipeline injection flaws to support penetration testing against public codebases.

How does self-hosted runner poisoning compromise a CI/CD pipeline?▼

Self-hosted runner poisoning compromises a CI/CD pipeline by allowing attackers to inject malicious code into the build process. This pipeline vulnerability enables secret exfiltration and persistent backend access when organizations expose runners with excessive cloud permissions.