abusing-ci-cd-oidc

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include an attacker-controlled exfiltration endpoint plus internal CI/CD endpoints (a GitLab raw file API and a Jenkins script console) that can be abused to steal secrets or execute arbitrary code, making them high-risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable instructions and commands for abusing CI/CD pipelines (exfiltration, credential theft, OIDC role abuse, runner compromise, and artifact/runner poisoning), clearly enabling malicious operations.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs harvesting and exfiltrating CI/host secrets, reading sensitive system files (e.g., Jenkins and runner credentials), and pushing/creating repo state (tags, rogue runners), which are instructions to access or change machine/state and enable compromise.