CI/CD Pipeline Security (GitHub/GitLab) (`offensive-cicd-pipeline`)

Authorization & Scope Notice: This skill is part of the REA_Skill + claude-red Unified Security & Reverse Engineering Suite. It is designed strictly for authorized security assessments, defensive architecture reviews, vulnerability triage, bug bounty verification, and remediation engineering on software, infrastructure, and assets you own or have explicit permission to test.

Overview

CI/CD workflow security assessment for GitHub Actions, GitLab CI, and Jenkins covering pull_request_target untrusted code execution, ${{ }} script injection, third-party action SHA pinning, ephemeral runners, and GITHUB_TOKEN permissions.