Offensive CI/CD Pipeline Exploitation
Guides an agent through attacking GitHub Actions, Jenkins, GitLab and Azure DevOps pipelines, with exploit code.
- Repository
- SnailSploit/Claude-Red
- Stars
- 10,230
- Licence
- MIT
- Files
- 1 file
What it does
This skill gives an AI agent a detailed playbook for attacking the automated build and deployment systems (CI/CD pipelines) that software teams use. Once installed, the agent can enumerate pipeline configuration files, find injection points where attacker-controlled input reaches code execution, map secrets and token permissions, and write working exploit payloads for GitHub Actions, Jenkins, GitLab CI and Azure DevOps. It also covers how to detect and defend against each technique, though its framing is offensive.
Great for
- Security professionals doing authorised penetration tests or red-team engagements against CI/CD systems
- Students and researchers learning how pipeline supply-chain attacks work, in lab environments
- Defenders who want concrete attack paths to test their own pipelines against
Skip it if
- Attacking any pipeline you do not own or have written permission to test; the skill supplies exploit code and credential-theft techniques that can cause real breaches and legal liability
- Beginners looking for general CI/CD setup help; the content assumes security expertise and is not a build tutorial
Try asking
- “Audit our GitHub Actions workflows for expression injection via PR titles and issue bodies (authorised test)”
- “Enumerate the Jenkins script console exposure and privilege paths in our staging controller”
- “Explain how a workflow_run artifact poisoning attack works and how to detect it in our repo”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the MIT licence and an attribution note.
offensive-cicd-pipeline.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip offensive-cicd-pipeline.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip offensive-cicd-pipeline.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Scope every engagement in writing first and restrict the agent to test repositories or lab instances; never point it at production pipelines or third-party orgs
- Review any generated payload (reverse shells, curl exfiltration to external hosts, credential dumps) before running it, since the skill's examples include attacker-hosted endpoints
- Ask for the defensive countermeasure and detection sections alongside each attack to get remediation output usable by a blue team
What's inside
- SKILL.md
Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.