---
title: "CI/CD SECURITY - Pipeline Attack Surface - Air Market"
description: "A target has public repos and an automated build system, and that build system is a place bugs get missed. This goes hunting there: workflows that can be made to run attacker input, secrets that can…"
canonical: "https://airmarket.ai/app/cicd-security"
---

[Air Market](/) / [Security](/category/security) / CI/CD SECURITY - Pipeline Attack Surface

Skill by [Md Shariar Shanaz Shuvon](/@shuvonsec)

# CI/CD SECURITY - Pipeline Attack Surface

Hunt the bugs that hide in a target's build pipeline

## What this does

A target has public repos and an automated build system, and that build system is a place bugs get missed. This goes hunting there: workflows that can be made to run attacker input, secrets that can be pulled out, build machines that can be poisoned, and dependency tricks. Reach for it when you are testing a target that builds in the open.

### Top 3 things it does for you

- Look for injection in a target's workflows
- Check whether secrets can be pulled out of CI
- Chain smaller pipeline bugs into something critical

## Information

**CI/CD SECURITY - Pipeline Attack Surface at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [Md Shariar Shanaz Shuvon](/@shuvonsec) |
| Category | [Security](/category/security) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Size | 12 KB |
| Licence | MIT |
| Repository | [shuvonsec/claude-bug-bounty](https://github.com/shuvonsec/claude-bug-bounty/tree/91304a03a991e0b398f8b40c04f2abe3ddac2441/skills/cicd-security) |
| GitHub stars | 4,407 (as of Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of CI/CD SECURITY - Pipeline Attack Surface and flagged nothing. AIR's verdict: **safe**.

**What CI/CD SECURITY - Pipeline Attack Surface's check was run against**

|  |  |
| --- | --- |
| Commit | 91304a03a991e0b398f8b40c04f2abe3ddac2441 |
| Content hash | 830fe2a90a39585fcbb367a17ee1cde24dd0bfa42c4ec48d07e407d4008739ef |
| Files read | [Browse the files at this exact commit](https://github.com/shuvonsec/claude-bug-bounty/blob/91304a03a991e0b398f8b40c04f2abe3ddac2441/skills/cicd-security/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for CI/CD SECURITY - Pipeline Attack Surface](/security/cicd-security)

## About CI/CD SECURITY - Pipeline Attack Surface

Security hunting aimed at CI/CD pipelines. It covers GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks.

The work combines sisakulint scanning with manual workflow analysis, and includes chaining CI/CD bugs together into critical findings rather than reporting them in isolation.

Use it when a target has public repos, or runs GitHub Actions, CircleCI, Jenkins, or GitLab CI.

## What's inside

- SKILL.md - instructions

## Questions

### Is CI/CD SECURITY - Pipeline Attack Surface safe to install?

AIR scanned this exact version of CI/CD SECURITY - Pipeline Attack Surface and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit 91304a03a991, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/cicd-security.

### How do I install CI/CD SECURITY - Pipeline Attack Surface?

Open https://airmarket.ai/app/cicd-security on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/shuvonsec/claude-bug-bounty/tree/91304a03a991e0b398f8b40c04f2abe3ddac2441/skills/cicd-security. Install from that link, not the branch.

## Related on Air Market

- [More Security listings](/category/security)
- [Everything by Md Shariar Shanaz Shuvon](/@shuvonsec)

---

Canonical URL: <https://airmarket.ai/app/cicd-security>