Offensive CI/CD Secrets Extraction
Methodology for extracting and pivoting with credentials from CI/CD pipelines (offensive use).
- Repository
- SnailSploit/Claude-Red
- Stars
- 10,230
- Licence
- MIT
- Files
- 1 file
What it does
This skill is a detailed attack playbook that teaches an AI agent how to hunt for and steal secrets (passwords, cloud keys, tokens, registry credentials) inside CI/CD build pipelines such as GitHub Actions, GitLab CI, Jenkins and Azure DevOps. It lists commands for dumping environment variables, probing HashiCorp Vault and AWS/Azure/GCP secrets managers, reading build logs and caches, abusing OIDC trust, and exfiltrating recovered values over HTTPS, DNS or ICMP, then using them to move further into systems. It is written from an attacker's point of view and maps to MITRE ATT&CK T1552.
Great for
- Authorized penetration testers who have written permission to assess a client's CI/CD pipelines
- Red team operators studying credential theft paths in build systems
- Security engineers building detection rules for CI/CD secret exfiltration
Skip it if
- Anyone testing systems they do not own or lack written authorization to test: the content is a ready-made theft guide and using it against others is illegal
- Defensive teams looking for remediation steps; this file describes attacks and gives little guidance on fixing them
- Beginners wanting to learn secure pipeline setup, since the content focuses on exploitation
Try asking
- “Enumerate which secrets are exposed in this CI runner's environment during an authorized pentest”
- “Test whether the Vault token in this pipeline is over-permissioned and list reachable KV paths”
- “Check build logs and caches in our client's GitHub Actions for leaked credentials and map their scope”
- “Assess whether the OIDC trust between our GitLab pipelines and AWS can be abused, as part of a signed-off engagement”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the MIT licence and an attribution note.
offensive-cicd-secrets.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip offensive-cicd-secrets.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip offensive-cicd-secrets.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Use only inside an engagement with a signed scope document and rules of engagement that cover CI/CD systems.
- The skill contains example commands that send data to attacker.com; replace these placeholders with your own authorized test infrastructure only, and log all activity.
- Ask the agent to report findings with remediation advice too, since the file itself is attack-focused.
What's inside
- SKILL.md
Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.