skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-cicd

Identify and validate CI/CD pipeline vulnerabilities in Jenkins and GitHub Actions.

3|1|Updated Jul 2, 2026
Search Tags:#security#github#jenkins#cicd#pentest#recon
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-cicd-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-cicd
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-cicd
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-cicd-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the high-risk surface area of CI/CD pipelines, where misconfigurations often lead to critical RCE, secret exfiltration, and unauthorized cloud access.

Core Features & Use Cases

  • Pipeline Vulnerability Detection: Identifies dangerous patterns like unauthenticated Jenkins script consoles, GitHub Actions Pwnrequest injections, and exposed Terraform state files.
  • Exploit Validation: Provides a rigorous framework to verify findings, ensuring that reported vulnerabilities are actionable and not false positives.
  • Use Case: Use this skill to audit a target organization's public GitHub repositories for insecure workflow triggers or to safely probe Jenkins instances for unauthenticated script execution.

Quick Start

Use the hunt-cicd skill to audit the target repository for insecure GitHub Actions workflow triggers and potential secret leakage.

Frequently Asked Questions about hunt-cicd

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify and exploit RCE vulnerabilities in Jenkins script consoles?▼

Jenkins script console RCE vulnerabilities are identified by auditing build infrastructure for unauthenticated access points and systematically verifying data flow into execution sinks to confirm remote code execution impact.

What are GitHub Actions workflow injection vulnerabilities and how can I detect them?▼

GitHub Actions workflow injection vulnerabilities occur when untrusted user input reaches execution sinks in public code repositories. You detect them by auditing insecure workflow triggers and rigorously validating the data flow to confirm exploitability.

How do I validate exposed infrastructure secrets during a CI/CD pipeline pentest?▼

Validating exposed infrastructure secrets during a CI/CD pipeline pentest requires checking credential validity to confirm actual impact, ensuring that discovered exposed secrets like Terraform state files are actionable and not false positives.

Can I use this approach to safely probe public GitHub repositories for insecure CI/CD configurations?▼

Yes, you can safely probe public GitHub repositories for insecure CI/CD configurations by applying offensive security assessments to detect dangerous patterns like Pwnrequest injections and exposed infrastructure secrets.

How do I avoid false positives when auditing CI/CD pipelines for security gaps?▼

Avoiding false positives when auditing CI/CD pipelines for security gaps requires a rigorous exploit validation framework that systematically verifies data flow into execution sinks and confirms credential validity before reporting findings.

Related Skills

Explore More Software Engineering Skills→
uphiagouphiago
1.1k

supply-chain-attack-recon

Identify external software supply chain attack surfaces across public GitHub organizations, container registries, and package repositories.

Community
Advanced
nksethnkseth

security-reviewer

Identify security vulnerabilities in code and infrastructure and deliver prioritized audit reports with remediation guidance.

Community
Advanced
arbazkhan971arbazkhan971
26

devsecops

Integrate security scanning into CI/CD pipelines with blocking gates.

Community
Advanced
zzw4257zzw4257

Checkov

Scan infrastructure-as-code files for security vulnerabilities and compliance deviations.

Community
Intermediate