# CI/CD Pipeline Code Injection

> Detects CI/CD pipeline scripts that incorporate untrusted input into shell commands, enabling pipeline injection attacks.

- Skill: `zakirkun/ci-cd-pipeline-code-injection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/ci-cd-pipeline-code-injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/ci-cd-pipeline-code-injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/ci-cd-pipeline-code-injection

---


# CI/CD Pipeline Code Injection

## Overview
CI/CD pipelines that execute shell commands incorporating untrusted values (branch names, commit messages, PR metadata) are vulnerable to injection. Attackers can create branches or issues with malicious names to execute arbitrary commands in the CI environment, accessing secrets.

## Remediation
- Quote all shell variables in CI scripts
- Use CI-specific secret mechanisms instead of environment variable interpolation
- Validate and sanitize branch names and other git metadata before use in scripts