skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

supply-chain-cicd

Analyze CI/CD pipeline configurations for injection vectors, secret exposure, and access controls.

Updated Jul 30, 2026
Search Tags:#security#injection#pipeline#devsecops#supply-chain#cicd
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill supply-chain-cicd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-cicd
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/supply-chain-cicd
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill supply-chain-cicd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill identifies critical security vulnerabilities in CI/CD pipeline configurations, such as secret exposure, injection vectors, and overly permissive access controls, without requiring live execution.

Core Features & Use Cases

  • Injection Vector Analysis: Detects dangerous patterns like pull_request_target triggers and unsanitized variable interpolation in shell commands.
  • Secret and Token Review: Audits secret references and token permissions to prevent credential leakage and unauthorized repository access.
  • Compliance Auditing: Reviews branch protection and environment controls to ensure secure deployment practices.

Quick Start

Use the supply-chain-cicd skill to audit the repository configuration files for security weaknesses and generate a risk assessment report.

Frequently Asked Questions about supply-chain-cicd

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check my GitHub Actions workflow for script injection vulnerabilities?▼

To check GitHub Actions for script injection, analyze your pipeline configuration for dangerous triggers like pull_request_target and unsanitized variable interpolation in shell commands. This identifies injection vectors without executing the pipeline.

What is a pull_request_target trigger and why is it a security risk in CI/CD?▼

A pull_request_target trigger runs CI/CD workflows with write access to secrets, making it a severe injection risk if it processes untrusted code. Auditing pipeline configurations statically detects this dangerous pattern before execution.

Can I audit secret exposure and token permissions in GitLab CI configurations?▼

Yes, you can audit secret exposure and token permissions in GitLab CI configurations. Static analysis reviews secret references and token scopes to prevent credential leakage and unauthorized repository access.

Does CI/CD pipeline security analysis require live execution or build agents?▼

CI/CD pipeline security analysis does not require live execution or build agents. It operates on static configuration definitions from GitHub Actions, GitLab CI, and Jenkins using read-only repository access.

How do I review branch protection and environment controls for deployment compliance?▼

Review branch protection and environment controls for deployment compliance by auditing your repository settings exports. This verifies secure deployment practices and improper access controls across your pipeline environments.

Related Skills

Explore More Software Engineering Skills→
jeremylongshorejeremylongshore
2.6k

building-cicd-pipelines

Generate CI/CD pipeline configurations for GitHub Actions, GitLab CI, and Jenkins.

Community
Intermediate
somachaksomachak

auditing-secrets-and-config

Audit code, configuration, and CI/CD pipelines for exposed secrets.

Community
Intermediate
brenordvbrenordv

security

Audit software systems for security vulnerabilities and regulatory compliance.

Community
Advanced
v1bh0rv1bh0r

nw-canary

Detect auto-injection activation status in runtime environments.

Community
Basic