What problem does it solve? Security researchers need a disciplined, evidence-gated method to check whether in-scope CI/CD surfaces—public repositories, build logs, artifacts, workflows, preview deployments, and webhooks—leak credentials, misconfigure authorization, or pull untrusted input into controlled builds, without triggering pipelines or causing side effects. ## Core Features & Use Cases - Trigger-Signal Routing: Activates on signals like build logs, artifact URLs, workflow files, Jenkins endpoints, deploy previews, and webhook configurations across GitHub, GitLab, Actions, Jenkins, and Argo. - Read-Only Modeling: Builds a source-to-deployment graph covering token masking, fork/PR policy, webhook signatures, and deploy approvals. - Minimal Safe Validation: Checks only publicly accessible logs and artifacts for owned canaries, and verifies webhook signature rejection paths without delivering build-triggering events. - Use Case: During an authorized engagement, you discover a public build log URL; the skill guides a baseline-to-oracle validation confirming whether an unauthorized identity can access artifacts that should be private, then routes credential findings to supply-chain review skills. ## Quick Start Ask the agent to run the hunt-cicd route against the authorized CI/CD scope and report any leaked credentials or authorization bypasses with evidence.
