<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-ci-cd-pipeline-poisoning
description: >-
  Analyze CI/CD pipelines for poisoning vectors including malicious workflow
  injection, compromised build steps, secret exfiltration, and unauthorized
  pipeline modifications. Detect PPE (Poisoned Pipeline Execution) attacks.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - ci-cd-security
  - pipeline-poisoning
  - ppe
  - build-security
  - github-actions
  - workflow-injection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Analyzing CI/CD Pipeline Poisoning

## Overview

CI/CD pipeline poisoning (PPE — Poisoned Pipeline Execution) attacks exploit the
trust relationship between code repositories and build systems. Attackers inject
malicious code into pipeline definitions, compromise shared actions/orbs, or
exfiltrate secrets through modified build steps. This skill covers detection of
pipeline poisoning vectors across GitHub Actions, GitLab CI, and Jenkins.

Mode: `[MODE: RED]` — Identify and analyze CI/CD pipeline poisoning attack vectors.

## Prerequisites

| Requirement | Details |
|---|---|
| GitHub CLI (`gh`) for workflow analysis | Required |
| actionlint for GitHub Actions linting | Required |
| yq for YAML processing | Required |
| git for repository analysis | Required |
| Python 3.10+ with `pyyaml`, `requests` | Required |

## Key Concepts

### Detecting Workflow Injection

```bash
# Find workflows triggered by pull_request_target (PPE vector)
grep -rn 'pull_request_target' .github/workflows/

# Detect expression injection in workflows
actionlint .github/workflows/*.yml 2>&1 | grep -i "injection"

# Find workflows that checkout PR HEAD (dangerous with pull_request_target)
grep -A5 'pull_request_target' .github/workflows/*.yml | grep 'ref.*head'

# Detect unsafe interpolation of user-controlled values
grep -rn '\${{.*github\.event\.(issue|pull_request|comment)' .github/workflows/
```

### Secret Exfiltration Detection

```bash
# Find workflows that expose secrets to forked PRs
grep -B10 -A10 'pull_request_target' .github/workflows/*.yml | grep -i 'secret'

# Detect curl/wget calls that could exfiltrate data
grep -rn 'curl\|wget\|nc\|ncat' .github/workflows/*.yml

# Check for base64 encoding of secrets (exfil indicator)
grep -rn 'base64\|b64encode\|btoa' .github/workflows/*.yml

# Audit environment variable exposure
grep -rn 'env:' .github/workflows/*.yml | grep -i 'secret\|token\|key\|password'
```

### Third-Party Action Pinning

```bash
# Find unpinned third-party actions (not using SHA)
grep -rn 'uses:' .github/workflows/*.yml | grep -v '@[a-f0-9]\{40\}' | grep -v 'actions/'

# List all third-party actions used
grep -rhn 'uses:' .github/workflows/*.yml | sort -u

# Verify action SHAs against expected values
gh api repos/owner/action/git/refs/tags/v1 --jq '.object.sha'
```

## Workflow

### Step 1: Scan CI/CD pipeline files for poisoning vectors

```bash
node scripts/agent.js --action scan --pipeline-dir /tmp/target --output /tmp/scan-result.json
```

### Step 2: Audit workflow configurations for security issues

```bash
node scripts/agent.js --action audit --pipeline-dir /tmp/target --output /tmp/audit-result.json
```

### Step 3: Generate pipeline security assessment report

```bash
node scripts/agent.js --action report --pipeline-dir /tmp/target --output /tmp/report-result.json
```

## Detection

```yaml
title: Ci Cd Pipeline Poisoning Detection
id: 39cc323a-03e8-447b-990f-ea954bc4cb92
status: experimental
description: Detects suspicious activity related to analyzing ci cd pipeline poisoning techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*analyzing*ci*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Ci Cd Pipeline Poisoning Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] No workflows use pull_request_target with PR HEAD checkout
- [ ] All third-party actions pinned to full SHA commit hashes
- [ ] No expression injection vulnerabilities in workflow files
- [ ] Secrets not exposed to fork-based pull request workflows
- [ ] No suspicious network calls in build steps

## References

- [Cycode PPE Research](https://cycode.com/blog/github-actions-vulnerabilities/)
- [GitHub Actions Security Hardening](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)
- [actionlint Documentation](https://github.com/rhysd/actionlint)
- [OWASP CI/CD Top 10](https://owasp.org/www-project-top-10-ci-cd-security-risks/)
