What problem does it solve? Security testers often over-report CI/CD findings because exposed dashboards and workflows look exploitable but are not. This Skill provides a structured methodology to find real CI/CD vulnerabilities — Jenkins script console RCE, GitHub Actions pull_request_target injection, self-hosted runner poisoning, OIDC trust-policy abuse, and Terraform state leakage — and prove each one with concrete validation before reporting. ## Core Features & Use Cases - Jenkins Exploitation & Validation: Fingerprint versions via X-Jenkins headers, test unauthenticated script consoles, exploit CVE-2024-23897 CLI file read, and dump the credential store with Groovy. - GitHub Actions Attack Paths: Identify Pwnrequest (pull_request_target) injection, ${{ }}-into-shell template injection, self-hosted runner poisoning, OIDC trust-policy abuse, and cache poisoning, with recon via gh CLI, actionlint, and zizmor. - Secrets & State Leakage: Hunt secrets in pipeline logs, artifacts, Docker image layers (trufflehog --only-verified), and public Terraform state files with jq-based live-credential confirmation. - Use Case: During a bug bounty engagement against an org with a public GitHub presence and an exposed Jenkins instance, use this Skill to enumerate dangerous workflows, confirm an injectable sink with an out-of-band Collaborator callback, and produce a validated Critical finding instead of a false positive. ## Quick Start Use the hunt-cicd skill to assess the target organization's GitHub workflows and exposed Jenkins instance for exploitable CI/CD vulnerabilities, validating each finding before reporting.
