How to use the Offensive CI/CD Pipeline Exploitation agent skill

What the skill makes the agent do

An agent skill is a folder containing a SKILL.md file with instructions that Claude loads when a request matches the skill's description. This one contains a methodology for attacking CI/CD pipelines. The agent can enumerate pipeline configuration files such as .github/workflows/, Jenkinsfile, .gitlab-ci.yml and azure-pipelines.yml, find places where attacker-controlled input reaches code execution, map token scopes and secrets, and write exploit payloads for each platform.

The source's quick workflow runs in seven steps: enumerate repositories and pipeline configs, identify which events trigger pipelines and which carry attacker-controlled input, map token scopes, select an injection vector for your access level, craft the payload, execute and capture output, then pivot using captured credentials. Each technique is paired with detection indicators and defensive countermeasures.

• GitHub Actions: expression injection via PR titles and issue bodies, workflow_run abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise
• Jenkins: Groovy sandbox escape, script console RCE, Java remoting deserialization, credential dumping, shared library injection
• GitLab CI: YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines
• Azure DevOps: pipeline agent compromise and service connection theft
• Mapped to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain)

How do you install the offensive-cicd-pipeline skill?

The skill is published in the SnailSploit/Claude-Red repository under Skills/cicd/offensive-cicd-pipeline and is licensed MIT. Download the skill ZIP from this page, then choose one of the two install routes below.

For a personal install, unzip the file into ~/.claude/skills/ so the folder containing SKILL.md sits there. For a single project, unzip it into the project's .claude/skills/ folder instead. In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/ (available across your projects)
• Project: .claude/skills/ inside the project folder (available only there)
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How do you trigger the skill with a natural request?

You do not need a special command. Describe the task in plain language and mention the platform and the authorised scope. Claude loads the skill when the request matches its description, which covers pipeline exploitation, injection vectors, token scope mapping and CI/CD attack paths.

State the engagement context early. The skill expects a authorised test or lab, and naming that context makes the agent's output more focused.

• "We have written permission to test the CI/CD pipelines of example-org. Enumerate the GitHub Actions workflows in this repo and list any expression injection sinks."
• "In our lab Jenkins instance, explain how the script console could expose stored credentials and how to detect that access."
• "Review our azure-pipelines.yml for risky service connection usage and tell me how to defend against theft."

Examples of what the skill covers

The GitHub Actions section includes a grep search that flags workflow lines where event data such as github.event.pull_request.title, github.head_ref or github.event.issue.body is interpolated into ${{ }} expressions. It also shows a vulnerable workflow that uses pull_request_target with a PR title in a run step, and the secure alternative of pinning actions to a commit SHA rather than a tag.

The source includes a command that queries the GitHub API to check token permissions, which helps you see what a compromised workflow could do. Use these examples to learn what to look for in your own workflows, and to write detection rules for them.

What do you need before running it?

The skill depends on several tools and inputs. For GitHub examples you need gato, a GitHub Actions attack tool. Jenkins examples need jenkins-attack-framework. Live enumeration needs a GitHub personal access token or other platform credentials. Reverse-shell and exfiltration examples need an attacker-controlled listener host.

The skill runs scripts and uses the network. Treat it as a tool that can touch live systems.

• gato (GitHub examples)
• jenkins-attack-framework (Jenkins examples)
• GitHub personal access token or other platform credentials for live enumeration
• An attacker-controlled listener host for reverse-shell and exfiltration examples

Safety notes: scripts and network access

Only point this skill at pipelines you own or have written permission to test. The skill supplies exploit code and credential-theft techniques that can cause real breaches and legal liability. Its framing is offensive, so keep your scope document open while you work.

Run it in a lab or an isolated test environment first. Do not paste real production tokens into prompts you would not want logged, and revoke any test credentials when the engagement ends. The skill's examples include placeholders such as ATTACKER_IP and TARGET_IP that you must replace deliberately, so check every command before executing it.

• Confirm written authorisation and scope before any live request
• Use lab or isolated environments for practice
• Rotate or revoke tokens and credentials used during testing
• Review every generated command before running it

Tips for getting useful results

Give the agent the actual pipeline files. Enumeration and injection-point identification work much better on real YAML or Jenkinsfile content than on descriptions. Name the platform, because the skill covers four and the techniques differ.

Ask for detection and defence alongside each attack. The skill includes detection indicators and countermeasures for each technique, which are often the most useful output for a defender.

• Paste or attach the specific workflow file rather than describing it
• Name one platform per request to keep answers focused
• Ask for detection indicators and countermeasures with every technique
• Check the skill's requirements before asking for live enumeration