Bytesagain Ci Cd Pipeline

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:42 AM UTC
• Version: 1.0.3

Overview

This skill is a CI/CD template generator, but some generated deployment templates handle production credentials and mutable CI dependencies in ways users should review before use.

Review and harden generated workflows before installing them in a repository, especially deployment jobs. Pin third-party actions to reviewed commit SHAs, use least-privilege tokens and Kubernetes RBAC, prefer ephemeral runners, store kubeconfig in a job-scoped temporary file with mode 0600, delete it after use, and add branch/environment approvals for production deployments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:188

Finding

Kubernetes Credentials Persisted Without Restrictive File Permissions or Cleanup

Content

View full analysis

~/.kube/config ``` ### Technical Analysis The generated GitHub Actions workflow decodes a Kubernetes configuration secret and writes it to the runner's persistent home directory. It does not establish a restrictive `umask`, explicitly set the file mode to `0600`, use a job-scoped temporary directory, or remove the credential after deployment. On an ephemeral GitHub-hosted runner, destruction of the runner limits the exposure window. However, the generated template does not require an ephemeral runner and may be used on a persistent or self-hosted runner. In that environment, `~/.kube/config` can remain available after the job finishes. Its effective permissions depend on the runner account's current `umask`. Any later process running as the same operating-system user may be able to read the kubeconfig. The credential's actual capabilities depend on the Kubernetes identity and RBAC permissions encoded in the supplied configuration. ### Attack Path 1. A project uses the generated Kubernetes workflow on a persistent or self-hosted runner. 2. The deployment job decodes `secrets.KUBE_CONFIG` into `~/.kube/config`. 3. The job finishes without deleting the credential file. 4. An attacker obtains code execution in a subsequent workflow, build step, compromised dependency, or another process running under the same runner account. 5. The attacker reads `~/.kube/config`. 6. The attacker uses the recovered server address and authentication material to connect to the Kubernetes API. 7. The attacker performs operations allowed by the associated Kubernetes RBAC identity. ### Impact Assessment Successful exploitation can disclose Kubernete ...[truncated 505 chars]

Remediation

View remediation

"$KUBECONFIG_FILE" chmod 600 "$KUBECONFIG_FILE" echo "KUBECONFIG=$KUBECONFIG_FILE" >> "$GITHUB_ENV" - name: Remove kubeconfig if: always() shell: bash run: | if [[ -n "${KUBECONFIG:-}" ]]; then rm -f -- "$KUBECONFIG" fi ``` Additional hardening measures: - Prefer ephemeral, isolated runners for deployment jobs. - Give the Kubernetes identity only the RBAC permissions required for deployment. - Use short-lived workload identity or OIDC-based authentication instead of long-lived kubeconfig credentials where supported. - Restrict deployment environments with approvals and protected branches. - Avoid sharing runner operating-system accounts between unrelated repositories or trust domains. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/script.sh:43

Finding

Generated CI Pipelines Execute Mutable and Unpinned Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

# v4.x.y - uses: actions/setup-node@ # v4.x.y - uses: docker/login-action@ # v3.x.y - uses: docker/metadata-action@ # v5.x.y - uses: docker/build-push-action@ # v5.x.y - uses: azure/setup-kubectl@ # v3.x.y ``` Use dependency-update automation, such as Dependabot or Renovate, to propose reviewed SHA updates while preserving immutable references. For Python dependencies: - Pin exact versions in a lock or constraints file. - Generate and verify package hashes. - Install with hash enforcement, for example: ```bash python -m pip install --require-hashes -r requirements.lock ``` - Avoid dynamically upgrading `pip` in every pipeline execution; select and pin a reviewed version. - Include CI tools such as `pytest` and `flake8` in the reviewed lock file rather than installing unconstrained latest versions. Further hardening should include: - Set explicit least-privilege workflow and job permissions. - Keep secrets out of jobs that do not require them. - Separate build and deployment jobs so untrusted build tooling cannot directly access production credentials. - Protect release and deployment workflows with environment approvals and branch protections. - Review action source code and publisher provenance before pinning it. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/script.sh (reported line 186)May include surrounding context.

sh

- uses: actions/checkout@v4
      - name: Set up kubectl
        uses: azure/setup-kubectl@v3
      - name: Configure kubeconfig
        env:
          KUBE_CONFIG: \${{ secrets.KUBE_CONFIG }}
        run: |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/script.sh (reported line 191)May include surrounding context.

sh

KUBE_CONFIG: \${{ secrets.KUBE_CONFIG }}
        run: |
          mkdir -p ~/.kube
          echo "\$KUBE_CONFIG" | base64 -d > ~/.kube/config
      - name: Deploy to Kubernetes
        run: |
          kubectl set image deployment/app app=\${{ env.IMAGE }}:latest

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises shell and environment-related capabilities but does not declare any explicit tool scope such as permissions or allowed-tools. That creates ambiguity about what the agent may execute, increasing the risk of overly broad command execution or environment access when generating or handling CI/CD pipeline content that often touches secrets, deployment steps, and infrastructure operations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/script.sh (reported line 190)May include surrounding context.

sh

env:
          KUBE_CONFIG: \${{ secrets.KUBE_CONFIG }}
        run: |
          mkdir -p ~/.kube
          echo "\$KUBE_CONFIG" | base64 -d > ~/.kube/config
      - name: Deploy to Kubernetes
        run: |

Static analysis

No suspicious patterns detected.