cicd-supply-chain

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The list mixes legitimate CI/provenance/registry endpoints (github, npm/pypi, rekor.sigstore.dev, slsa.dev, token.actions.githubusercontent.com) with multiple high-risk items — attacker-controlled OOB domains (OOB.attacker.tld, attacker.tld), cloud IMDS endpoints (169.254.169.254), a Jenkins /script endpoint, and unpinned/mutable GitHub workflow/action refs — all of which are commonly abused for CI/pipeline poisoning, credential exfiltration, dependency confusion and distributing malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content includes explicit offensive techniques and working payloads for secret exfiltration, remote code execution, mutable-tag poisoning, cache poisoning, runner backdoors, and a self‑replicating worm — indicating deliberate malicious capability and high abuse risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text is ingested when scripts/workflow_auditor.py runs in --repos mode: it fetches workflow files from public GitHub repos at runtime (download_url → raw.text) and then scans that text for injection/pwn-request sinks, which is outsider-authored content.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running offensive scripts on compromised self-hosted runners (runner_recon.sh), discusses runner backdoors, Jenkins Script Console RCE, persistence and secret exfiltration, and other actions that encourage modifying host state and installing persistent/backdoor artifacts—i.e. it directs the agent to perform actions that compromise the machine state.