# Code Review Cicd

> Review CI/CD pipelines for security flaws — poisoned workflows, secret leakage, and injection. Load on GitHub Actions / GitLab CI / Jenkins config, ".github/workflows", pull_request_target, self-hosted runners, or "pipeline security". Signals: workflow YAML, secrets in CI, third-party actions.

- Skill: `noorqureshi/code-review-cicd` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/code-review-cicd`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/code-review-cicd/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/code-review-cicd

---


# CI/CD pipeline security review

## When it applies
You can read a repo's CI config (GitHub Actions, GitLab CI, Jenkinsfile, CircleCI). Pipelines run
with secrets and often on attacker-influenced input (PRs), making them a high-value, under-reviewed target.

## Why it works
CI runs code with privileged tokens/secrets. Misconfigurations let a fork PR run in a trusted
context, inject commands via untrusted inputs, or exfiltrate secrets — a supply-chain foothold. On
public repos this can be exploitable by anyone who opens a PR.

## Method
1. **Dangerous triggers**: `pull_request_target` / `workflow_run` that check out and run **PR code**
   with secrets in scope → fork PRs can steal secrets or run arbitrary code (the classic GitHub Actions bug).
2. **Script injection**: untrusted data (`github.event.issue.title`, PR body, branch name) used
   directly in `run:` shells → command injection. Look for `${{ github.event.* }}` in `run` blocks.
3. **Secret handling**: secrets echoed/logged, passed to third-party actions, or available to fork PRs;
   overly broad `permissions:` (default `write`), long-lived `GITHUB_TOKEN`.
4. **Untrusted dependencies**: third-party actions pinned to a mutable tag/branch (not a SHA),
   curl-pipe-to-shell steps, unpinned package installs → supply-chain.
5. **Self-hosted runners** on public repos: fork PRs executing on your infra → RCE on the runner.

## Gotchas
- `pull_request` (safe-ish) vs `pull_request_target` (dangerous) — the trigger name is the crux.
- An action pinned to `@v3` (tag) can be moved; require a full commit SHA for third-party actions.
- Secret leakage often happens via a step passing `${{ secrets.X }}` to an untrusted action.

## Verify success
A concrete path where an outsider (fork PR / issue) can execute code with pipeline privileges or
exfiltrate a secret, or a clear secret-leak/injection in the workflow.

## References
GitHub Actions security hardening docs; "GitHub Actions pwn requests" (Nathan Davison); semgrep CI rules.