# Offensive Cicd Secrets

Comprehensive secrets extraction methodology targeting CI/CD environments across all...

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-cicd-secrets -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-cicd-secrets -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-cicd-secrets -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-cicd-secrets -g -a gemini-cli -y`

## Description

Comprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for using recovered secrets to expand access.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Offensive CI/CD Secrets Extraction

Secrets in CI/CD environments are the primary objective for pipeline compromise. Every pipeline
holds credentials -- deployment keys, cloud provider tokens, API secrets, registry passwords,
database connection strings -- and the mechanisms protecting them are consistently weaker than
those guarding production secrets. You exploit the fundamental tension in CI/CD design: pipelines
need credentials to deploy, but the environments executing pipelines are transient, shared, and
often accessible to anyone who can open a pull request.

This skill systematically covers every extraction path across CI/CD platforms, from trivial
environment variable dumps to sophisticated OIDC federation abuse. You enumerate what secrets
exist, determine which extraction technique applies, recover the credentials, and pivot to
expand your access.

MITRE ATT&CK: T1552 (Unsecured Credentials), T1552.001 (Credentials In Files), T1552.004
(Private Keys), T1552.007 (Container API)

## Quick Workflow

1. Gain code execution in a CI/CD pipeline (see offensive-cicd-pipeline skill for injection vectors).
2. Enumerate the execution environment -- platform, runner type, available tools, network access.
3. Dump all environment variables and filter for secrets patterns.
4. Query platform-specific credential stores using available tokens (GITHUB_TOKEN, CI_JOB_TOKEN, PAT).
5. Check for vault/secrets-manager integrations and test for misconfigurations.
6. Examine build logs, caches, and artifacts for leaked credentials.
7. Test OIDC federation trust if cloud provider integration is present.
8. Validate recovered credentials and determine their scope.
9. Pivot using recovered secrets to access additional systems, registries, and cloud resources.

---

## Environment Variable Extraction

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/cicd/offensive-cicd-secrets/SKILL.md