Cicd Templates Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:35 AM UTC
• Version: 1.0.1

Overview

This skill is a CI/CD template generator, but some generated pipelines can run unverified remote shell scripts or deploy/publish with credentials without enough safeguards.

Install only if you are comfortable reviewing every generated workflow before committing it. Avoid or rewrite the GitLab Codecov and Jenkins GoReleaser templates that pipe remote scripts into bash, verify deploy/publish jobs before enabling them, and use tightly scoped CI secrets on isolated runners.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: cicd_gen/generator/gitlab_ci.py:94

Finding

Unverified Codecov Script Downloaded and Executed in GitLab CI

Content

View full analysis

Vulnerability Details

File Location: cicd_gen/generator/gitlab_ci.py:94-101
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

python

if coverage:
    pipeline["coverage"] = {
        "image": image, "stage": "coverage",
        "script": ["curl -s https://codecov.io/bash | bash"],
        "needs": ["test"],
    }

Technical Analysis

When coverage is enabled, the generator creates a GitLab CI job that retrieves a script from https://codecov.io/bash and pipes the response directly into Bash. The remote content is not pinned to an immutable version and is not validated using a checksum or cryptographic signature.

This design makes the effective code executed by the pipeline dependent on whatever content the remote endpoint returns at runtime. Compromise of the endpoint, its hosting infrastructure, or the associated network trust path could therefore turn the coverage job into an arbitrary-code execution channel.

Coverage processing and upload do not inherently require executing a mutable remote response. The behavior exceeds the minimum privileges necessary for the declared coverage-reporting functionality.

Attack Path

1. A user enables coverage and generates a GitLab CI configuration.
2. The generated .gitlab-ci.yml is committed and executed by a GitLab runner.
3. The coverage job requests the current content of https://codecov.io/bash.
4. An upstream compromise or malicious response supplies attacker-controlled shell commands.
5. Bash executes those commands under the GitLab runner account.
6. The payload can access resources exposed to the job, including the checkout, artifacts, network connectivity, and any CI variables available to that job.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the GitLab runner job. Depending on runner configuration and variable p ...[truncated 386 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | bash execution pattern.
• Prefer GitLab's native Cobertura artifact support when external upload is unnecessary.
• If Codecov upload is required, use an official, fixed-version uploader rather than the mutable legacy Bash endpoint.
• Download the uploader as a separate step, verify a vendor-published cryptographic checksum or signature, and only then execute it.
• Pin any uploader container to an immutable image digest.
• Restrict the coverage job's CI variables and runner permissions to the minimum required.
• Add automated tests that reject generated pipeline commands matching network-to-shell patterns such as curl ... | bash or wget ... | sh.

T03 · Remote Payload Retrieval and Execution

Error

• Location: cicd_gen/generator/jenkins.py:177

Finding

GoReleaser Installer Retrieved Through a Mutable Short URL and Executed by Jenkins

Content

View full analysis

Vulnerability Details

File Location: cicd_gen/generator/jenkins.py:177-183
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

python

if release == "goreleaser":
    result += """
        stage('Release with GoReleaser') {
            steps {
                sh 'curl -sL https://git.io/goreleaser | bash'
            }
        }"""

Technical Analysis

Selecting GoReleaser causes the generated Jenkinsfile to follow redirects from the shortened URL https://git.io/goreleaser and execute the returned content directly with Bash.

The generated command provides no immutable version, checksum verification, signature validation, or opportunity to inspect the downloaded file. Use of a short URL additionally obscures and externalizes control over the final payload location. The code executed during a future Jenkins build can consequently differ from the code assessed when the Skill is reviewed.

Installing GoReleaser does not require granting an arbitrary remote response immediate shell execution. A fixed release binary, verified archive, or digest-pinned container would satisfy the declared release functionality with substantially lower risk.

Attack Path

1. A user requests a Jenkins pipeline with release="goreleaser".
2. The generator writes the vulnerable release stage into Jenkinsfile.
3. Jenkins executes the release stage on an agent.
4. curl -L follows the short URL's redirect to its current destination.
5. If the redirect or destination content is compromised, attacker-controlled commands are returned.
6. Bash executes those commands with the Jenkins agent's privileges.
7. The payload can inspect the workspace, access environment variables available to the stage, modify release artifacts, and use the agent's network access.

Impact Assessment

Successful exploitation provides arbitrary code execution as the Jenkins age ...[truncated 587 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the short-URL curl | bash installer entirely.
• Select a fixed GoReleaser release rather than latest or another mutable reference.
• Download the release archive from the official release repository and verify its published checksum or signature before installation.
• Alternatively, execute GoReleaser from an official container pinned by immutable digest.
• Run release stages on isolated, ephemeral agents with narrowly scoped credentials.
• Prevent untrusted pull-request builds from reaching release credentials.
• Add generator tests that fail if generated Jenkinsfiles pipe network responses into a shell.

T09 · Insecure Skill Coding Practices

Warning

• Location: cicd_gen/generator/gitlab_ci.py:62

Finding

CI Credentials Exposed Through Process Arguments and Persistent Package-Manager Configuration

Content

View full analysis

Vulnerability Details

File Locations: cicd_gen/generator/gitlab_ci.py:62-68, cicd_gen/generator/gitlab_ci.py:82-88, cicd_gen/generator/gitlab_ci.py:128-134, cicd_gen/generator/jenkins.py:81-87, and cicd_gen/generator/jenkins.py:141-146
Vulnerability Type: Insecure secret handling
Risk Level: Medium

Vulnerable Code:

python

deploy_job = {
    "image": {"name": "docker:latest", "entrypoint": [""]},
    "stage": "deploy",
    "services": ["docker:dind"],
    "script": [
        "docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY",
        "docker build -t $CI_REGISTRY_IMAGE:latest .",
        "docker push $CI_REGISTRY_IMAGE:latest",
    ],
}

python

deploy_job = {
    "image": image,
    "stage": "deploy",
    "script": [
        "pip install azure-cli",
        "az login --service-principal -u $AZURE_CLIENT_ID "
        "-p $AZURE_CLIENT_SECRET --tenant $AZURE_TENANT_ID",
        "az webapp up --name $AZURE_WEBAPP_NAME --location eastus",
    ],
}

python

deploy_job = {
    "image": image,
    "stage": "deploy",
    "script": [
        "npm config set //registry.npmjs.org/:_authToken=$NPM_TOKEN",
        "npm publish --access public",
    ],
    "only": ["tags"],
}

python

elif deploy == "azure":
    return """
        stage('Deploy to Azure') {
            steps {
                sh 'pip install azure-cli'
                sh 'az login --service-principal -u $AZURE_CLIENT_ID -p $AZURE_CLIENT_SECRET --tenant $AZURE_TENANT_ID'
                sh 'az webapp up --name $AZURE_WEBAPP_NAME --location eastus'
            }
        }"""

python

if release == "npm":
    result += """
        stage('Publish npm') {
            steps {
                sh 'npm config set //registry.npmjs.org/:_authToken=$NPM_TOKEN'
                sh 'npm publish --access public'
            }
    
...[truncated 2157 chars]

Remediation

View remediation

Remediation Suggestions

• Replace Docker password arguments with standard input:

  sh

  printf '%s' "$CI_REGISTRY_PASSWORD" | docker login \
    --username "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
  

• Use CI-native credential bindings or temporary credential files for Azure authentication instead of exposing secrets in process arguments.
• In Jenkins, use withCredentials with narrowly scoped credential IDs and ensure secrets are unavailable outside the required stage.
• For npm publishing, create a temporary .npmrc with restrictive permissions, use it only for the publish command, and remove it in an unconditional cleanup block.
• Prefer ephemeral runners and workspaces; do not reuse credential-bearing environments across unrelated projects.
• Disable shell tracing around secret-handling commands and verify that CI masking is configured.
• Use short-lived, narrowly scoped tokens and rotate any credential suspected of exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · cicd_gen/generator/github_actions.py (reported line 175)May include surrounding context.

python

steps.extend([
                {"name": "Configure kubectl",
                 "uses": "azure/k8s-set-context@v3",
                 "with": {"kubeconfig": "${{ secrets.KUBE_CONFIG }}"}},
                {"name": "Deploy to Kubernetes",
                 "uses": "azure/k8s-deploy@v5",
                 "with": {"manifests": "k8s/", "namespace": "default"}},

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The generated pipeline executes a remotely fetched script directly via 'curl ... | bash', which gives the external host full code execution in the CI runner at build time. If the remote script, CDN, DNS, TLS termination, or upstream account is compromised, attackers can run arbitrary commands, steal CI secrets, modify artifacts, or tamper with releases.

Content

Scanner excerpt · cicd_gen/generator/gitlab_ci.py (reported line 98)May include surrounding context.

python

if coverage:
            pipeline["coverage"] = {
                "image": image, "stage": "coverage",
                "script": ["curl -s https://codecov.io/bash | bash"],
                "needs": ["test"],
            }
        if deploy_job:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The command 'curl -sL https://git.io/goreleaser | bash' fetches executable content from an external short URL and immediately runs it, preventing meaningful review or integrity validation. In CI context this is especially dangerous because Jenkins jobs often hold repository credentials, package tokens, cloud credentials, or signing material that could be stolen or abused by malicious script content.

Content

Scanner excerpt · cicd_gen/generator/jenkins.py (reported line 181)May include surrounding context.

python

result += """
        stage('Release with GoReleaser') {
            steps {
                sh 'curl -sL https://git.io/goreleaser | bash'
            }
        }"""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language content of the design is entirely in Chinese and does not state that language choice is optional or user-selectable. Under SQP-3, forcing a specific language without opt-in is a policy concern unless the locale constraint is explicitly justified or the user is offered a choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger examples include very broad natural-language phrases such as asking for a CI/CD workflow in general, which can cause the skill to activate outside a narrowly intended scope. In this context, accidental invocation is risky because the skill can generate workflows that may later write repository files or enable build, publish, and deployment behavior affecting CI infrastructure and external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill describes generating CI/CD workflows, including Docker push and cloud deployment paths, but does not clearly warn that outputs may be written into a repository or may encode behavior that publishes artifacts or deploys to external environments. That omission can mislead users into treating the output as harmless scaffolding when it can materially change automation behavior and consume secrets or trigger releases once committed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The workflow generator wires dependencies backwards by setting the test job to depend on the deploy job, which causes deployment to execute before validation. In CI/CD context this is dangerous because untested code can be pushed to production or deployment targets, increasing the chance of service disruption, bad releases, or unsafe artifacts being published before failures are detected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Azure deploy branch injects commands that use sensitive environment variables (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID) and performs a live deployment via az webapp up. In this file there is no confirmation prompt, log/comment warning, or docstring disclosure explaining that credentials will be consumed and a deployment will be executed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code generates a Jenkins stage that logs into Azure using sensitive environment variables and immediately deploys a webapp. There is no confirmation prompt, warning message, or explanatory comment in this file indicating that credentials will be used and a live deployment will occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The generated Jenkins stage runs kubectl apply -f k8s/, which can modify live cluster resources. The file provides no confirmation, warning, or descriptive notice that this operation changes Kubernetes state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The generated pipeline installs the Serverless CLI and runs serverless deploy, which can create or update cloud resources. There is no user disclosure, confirmation, or comment warning that this is a real deployment action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This generated stage configures an npm auth token and publishes to the public registry, which is an externally visible and potentially irreversible release action. The file contains no confirmation, warning, or explanatory note about using credentials and publishing artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This generator emits a pipeline stage that downloads and immediately executes a remote script via 'curl | bash', which creates a supply-chain execution path with no integrity verification or pinning. If the remote endpoint, redirect, or transport path is compromised, arbitrary code will run in the Jenkins build environment, potentially exposing secrets and enabling further compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The supported scenarios include Docker push, cloud deployment targets, npm publish, and goreleaser-related release workflows, which commonly involve credentials and outbound publishing behavior. The markdown does not include any warning that generated templates may reference secrets, registries, or deployment credentials, leaving out user-facing disclosure about privacy and system-impacting behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes generating directly committable CI/CD files and, later, automatic output directory creation, but it does not warn users that running the tool will create or overwrite files in repository paths. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system integrity, and filesystem modification is explicitly part of the described behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Natural-language policy violations include forcing a specific language without user opt-in. This skill content is presented in mixed languages, and the primary purpose statement is Chinese-only, with no note that users may choose language or that the skill is intended for a Chinese-language audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.