CI/CD Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:18 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent CI/CD workflow generator, but its production deployment templates use sensitive deploy credentials with mutable or unpinned third-party tooling and a privileged VPS restart command.

Review and harden generated deployment workflows before committing them. Pin third-party actions to reviewed commit SHAs, pin deployment CLI versions or use a locked project dependency, protect production environments with required reviewers, scope all tokens narrowly, and avoid unrestricted sudo for VPS deploy users.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:520

Finding

Mutable GitHub Action Tags in Privileged Deployment Workflows

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:351, SKILL.md:520, SKILL.md:539, SKILL.md:550, and SKILL.md:573
Vulnerability Type: Supply-chain risk from mutable GitHub Action references
Risk Level: Medium

Vulnerable Code

yaml

- uses: dorny/paths-filter@v3

yaml

- name: Deploy via SSH
  uses: appleboy/ssh-action@v1
  with:
    host: ${{ secrets.VPS_HOST }}
    username: ${{ secrets.VPS_USER }}
    key: ${{ secrets.VPS_SSH_KEY }}
    port: ${{ secrets.VPS_PORT }}

yaml

- name: Deploy via rsync
  uses: burnett01/rsync-deployments@7

yaml

- name: Restart service
  uses: appleboy/ssh-action@v1
  with:
    host: ${{ secrets.VPS_HOST }}
    username: ${{ secrets.VPS_USER }}
    key: ${{ secrets.VPS_SSH_KEY }}
    port: ${{ secrets.VPS_PORT }}

yaml

- uses: appleboy/ssh-action@v1
  with:
    host: ${{ secrets.VPS_HOST }}
    username: ${{ secrets.VPS_USER }}
    key: ${{ secrets.VPS_SSH_KEY }}

The Skill also explicitly requires mutable major-version tags:

markdown

3. **Always pin action versions** to major tags (e.g., `@v6`), never `@latest` or `@main`.

Technical Analysis

GitHub Action major-version tags such as @v1, @v3, and @7 are mutable references. The repository owner of an action can move such a tag to a different commit after the workflow has been reviewed. Consequently, the code executed by a generated workflow can change without any corresponding modification in the consuming repository.

This is particularly sensitive for the SSH and rsync deployment actions because their steps receive production connection information and private SSH keys. A compromised upstream action release, maintainer account, or mutable tag could cause attacker-controlled code to execute inside the workflow runner with access to the step's inputs and available credentials.

No currently malicious upstream action was ...[truncated 1522 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every third-party GitHub Action to a reviewed, full 40-character commit SHA rather than a branch or version tag.

• Preserve readability by adding the corresponding release number in a comment:

  yaml

  - uses: appleboy/ssh-action@0123456789abcdef0123456789abcdef01234567 # v1.x.y
  

• Apply SHA pinning to first-party actions as well, including actions/checkout and runtime setup actions.

• Use Dependabot or Renovate to propose controlled SHA updates that can be reviewed before adoption.

• Restrict each workflow's permissions block to the minimum required capabilities.

• Protect production jobs with GitHub Environments, required reviewers, branch restrictions, and environment-scoped secrets.

• Use a dedicated deployment account with no interactive login, no unrestricted sudo, and access limited to the required application directory and service.

• Prefer short-lived credentials or an identity-federation mechanism over reusable SSH private keys where the deployment platform supports it.

• Review the source and release provenance of every third-party action before adding or updating it.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:443

Finding

Unpinned Deployment CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:443, SKILL.md:460, and SKILL.md:489
Vulnerability Type: Unpinned executable package installation in deployment workflows
Risk Level: Medium

Vulnerable Code

yaml

- run: npm i -g vercel

The production deployment template repeats the same installation:

yaml

- run: npm i -g vercel

The Railway template contains an unpinned package installation and incorrectly places the shell command under uses:

yaml

- uses: npm i -g @railway/cli

Technical Analysis

The Vercel templates install whichever package version the npm registry resolves as the latest vercel release at workflow execution time. The generated workflow therefore does not have a reproducible or reviewable deployment toolchain. A compromised package release, publisher account, dependency, or registry response could introduce code that was not present when the workflow was generated or reviewed.

The Vercel CLI subsequently runs with VERCEL_TOKEN supplied as a command-line argument and with project identifiers available through the job environment. Malicious CLI code would receive the token directly and could misuse it within the permissions of the associated Vercel account.

The Railway command has the same version-pinning concern, but it is additionally malformed because shell commands must use run, not uses. As written, that example is expected to fail workflow validation or action resolution rather than successfully install the CLI. Correcting the syntax without adding an exact version would preserve the supply-chain weakness.

Attack Path

1. The Skill generates a deployment workflow containing npm i -g vercel.
2. The workflow is committed without pinning the CLI to a reviewed version.
3. A future latest Vercel CLI release, its publisher account, or a transitive dependency is compromised.
4. A deployment event causes npm to install the compromise ...[truncated 944 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each deployment CLI to a reviewed exact version:

  yaml

  - run: npm install --global vercel@REVIEWED_EXACT_VERSION
  

• Correct the Railway syntax and pin its version:

  yaml

  - run: npm install --global @railway/cli@REVIEWED_EXACT_VERSION
  

• Prefer declaring deployment CLIs in a project manifest and committing the associated lockfile. Execute them with the locked package manager rather than installing the current global release.

• Use npm integrity and provenance information during dependency review, and update versions through reviewed dependency-management pull requests.

• Give deployment tokens only the minimum project and operation scope necessary.

• Store production tokens in protected GitHub Environments with required approval and branch restrictions.

• Rotate deployment credentials immediately if a package executed by a privileged workflow is later found to have been compromised.

• Avoid passing secrets in command-line arguments when the CLI supports a protected environment variable or another less observable credential mechanism.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 598)May include surrounding context.

• VPS_SSH_KEY — private SSH key (ed25519 recommended)
• VPS_PORT — SSH port (default 22)
• DOCKERHUB_USERNAME — Docker Hub username
• DOCKERHUB_TOKEN — Docker Hub access token

text

Only list secrets relevant to the chosen deploy target.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says to use the skill when the user says phrases like 'set up CI', 'create pipeline', 'add CI', and 'create workflow'. Several of these are generic requests that could apply in many contexts beyond GitHub Actions CI/CD generation, and the file does not provide exclusion conditions or negative examples to narrow activation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

Present the detection results and ask:

1. **Deploy target** (if not obvious from vercel.json/railway.toml):
   - Vercel (auto-deploy via git push, or CLI-based)
   - Railway (auto-deploy or CLI)
   - VPS via SSH (rsync + restart)
   - Docker registry (GHCR, Docker Hub, ECR)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

Present the detection results and ask:

1. **Deploy target** (if not obvious from vercel.json/railway.toml):
   - Vercel (auto-deploy via git push, or CLI-based)
   - Railway (auto-deploy or CLI)
   - VPS via SSH (rsync + restart)
   - Docker registry (GHCR, Docker Hub, ECR)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.

md

Present the detection results and ask:

1. **Deploy target** (if not obvious from vercel.json/railway.toml):
   - Vercel (auto-deploy via git push, or CLI-based)
   - Railway (auto-deploy or CLI)
   - VPS via SSH (rsync + restart)
   - Docker registry (GHCR, Docker Hub, ECR)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 468)May include surrounding context.

md

Present the detection results and ask:

1. **Deploy target** (if not obvious from vercel.json/railway.toml):
   - Vercel (auto-deploy via git push, or CLI-based)
   - Railway (auto-deploy or CLI)
   - VPS via SSH (rsync + restart)
   - Docker registry (GHCR, Docker Hub, ECR)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 497)May include surrounding context.

md

Present the detection results and ask:

1. **Deploy target** (if not obvious from vercel.json/railway.toml):
   - Vercel (auto-deploy via git push, or CLI-based)
   - Railway (auto-deploy or CLI)
   - VPS via SSH (rsync + restart)
   - Docker registry (GHCR, Docker Hub, ECR)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The suggested SSH deploy workflow includes sudo systemctl restart APP_SERVICE on a remote host. Embedding privileged remote commands in generated automation increases blast radius if the workflow, SSH target, or called service name is misconfigured or compromised, and encourages root-level operations without least-privilege safeguards.

Content

Scanner excerpt · SKILL.md (reported line 556)May include surrounding context.

username: ${{ secrets.VPS_USER }} key: ${{ secrets.VPS_SSH_KEY }} port: ${{ secrets.VPS_PORT }} script: sudo systemctl restart APP_SERVICE

text

**Required secrets:** `VPS_HOST`, `VPS_USER`, `VPS_SSH_KEY`, `VPS_PORT`

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The generated deploy step pulls a mutable image tag (:main) without pinning to an immutable digest. This can lead to non-reproducible deployments and creates supply-chain risk if the tag is retargeted or overwritten, causing the VPS to run unintended code.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest describes a skill for generating GitHub Actions CI/CD pipelines tailored to the current project. Reading git remote get-url origin is used only to offer a README status badge, which is ancillary to pipeline generation and accesses repository configuration outside the core workflow-generation task.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.