The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of shell scripts and Groovy code to execute system-level commands for enumeration and exploitation across GitHub Actions, Jenkins, and GitLab runners.
[DATA_EXFILTRATION]: Functional payload templates are provided to send sensitive environment data, tokens, and secrets to external domains (e.g., attacker.com) using curl and POST requests.
[CREDENTIALS_UNSAFE]: Includes specific methodologies and code for dumping Jenkins credentials using the CredentialsProvider API and extracting Azure DevOps service connection secrets and tokens through pipeline execution.
[REMOTE_CODE_EXECUTION]: Provides detailed instructions for achieving arbitrary code execution via GitHub Actions expression injection, Jenkins Groovy script console access, and Java remoting deserialization vulnerabilities.
[OBFUSCATION]: Recommends using Base64 encoding for exfiltrating environment variables and secrets to bypass simple text-based monitoring and security filters.
[PRIVILEGE_ESCALATION]: Describes techniques to escalate privileges from a repository contributor to full runner or controller code execution by abusing pipeline configurations and trust boundaries.
[DYNAMIC_EXECUTION]: Demonstrates the use of Groovy's .execute() method for direct command execution and details the creation of Java deserialization payloads using ysoserial for remote execution.
[PERSISTENCE]: Outlines methods for maintaining long-term access by poisoning build artifacts, modifying CI/CD workflow definitions, and registering rogue runners to intercept future jobs.

offensive-cicd-pipeline