Detecting Supply Chain Attacks
FreeAutomate detection of supply chain risks in CI/CD pipelines.
Free · Opens the source repo
What Detecting Supply Chain Attacks does
This skill is designed to enhance the security of CI/CD workflows by automating the detection of potential supply chain attack vectors. It scans GitHub Actions workflows and CI/CD pipeline configurations, identifying critical security risks such as unpinned dependencies, script injection vulnerabilities, and exposure of sensitive information. By leveraging libraries like PyGithub and YAML parsing, the skill provides a systematic approach to auditing CI/CD environments, making it an essential tool for security teams and developers focused on DevSecOps practices.
When executed, the skill parses YAML files in GitHub Actions workflows, checking for common security pitfalls. It specifically looks for unpinned actions—those that reference branches instead of fixed commit hashes—along with script injection risks that could allow malicious code execution. Additionally, it assesses the permissions of GITHUB_TOKEN and flags third-party actions that may pose a risk due to excessive access rights. This comprehensive scanning process helps teams identify and mitigate vulnerabilities before they can be exploited.
The skill is particularly useful for security operations center (SOC) analysts and developers who need to validate their CI/CD pipeline security. It can be employed during incident investigations or as part of routine security audits to ensure that best practices are being followed. By providing structured procedures and automated checks, it facilitates a proactive approach to supply chain security, aligning with modern DevSecOps methodologies.
In summary, this skill serves as a valuable resource for anyone involved in securing CI/CD processes, offering a straightforward way to enhance the integrity of software delivery pipelines.
When to use it
Use this skill when you need to audit CI/CD workflows for security vulnerabilities or during security incident investigations.
When not to use it
This skill may not be suitable for environments that do not use GitHub Actions or for teams without a basic understanding of security operations.
What you can build with it
Auditing CI/CD Pipelines
Use this skill to perform automated security audits of your CI/CD workflows, identifying potential supply chain risks.
Incident Response
In the event of a security incident, leverage this skill to quickly assess your CI/CD configurations for vulnerabilities.
Security Compliance Checks
Regularly validate your CI/CD pipeline against security best practices to maintain compliance and reduce risk.
How to install Detecting Supply Chain Attacks
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-supply-chain-attacks-in-ci-cd --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting Supply Chain Attacks in CI/CD
When to Use
- When investigating security incidents that require detecting supply chain attacks in ci cd
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Familiarity with security operations concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
Scan CI/CD workflow files for supply chain risks by parsing GitHub Actions YAML, checking for unpinned dependencies, script injection vectors, and secrets exposure.
import yaml
from pathlib import Path
for wf in Path(".github/workflows").glob("*.yml"):
with open(wf) as f:
workflow = yaml.safe_load(f)
for job_name, job in workflow.get("jobs", {}).items():
for step in job.get("steps", []):
uses = step.get("uses", "")
if uses and "@" in uses and not uses.split("@")[1].startswith("sha"):
print(f"Unpinned action: {uses} in {wf.name}")
Key supply chain risks:
- Unpinned GitHub Actions (using @main instead of SHA)
- Script injection via ${{ github.event }} expressions
- Overly permissive GITHUB_TOKEN permissions
- Third-party actions with write access to repo
- Dependency confusion via public/private package name collision
Examples
# Check for script injection in run steps
for step in job.get("steps", []):
run_cmd = step.get("run", "")
if "${{" in run_cmd and "github.event" in run_cmd:
print(f"Script injection risk: {run_cmd[:80]}")
Frequently asked questions about Detecting Supply Chain Attacks
Similar skills
GitHub Actions Hardening
Enhance the security of your GitHub Actions workflows.
Sensitive Logging Audit
Audit and fix sensitive data exposure in Python logging.
Android App Static Analysis
Automate security assessments of Android apps with MobSF.
Integrating DAST with OWASP ZAP
Seamlessly integrate dynamic security testing into CI/CD pipelines.
Implementing Runtime Security with Tetragon
Enhance Kubernetes security with eBPF-based observability.
Implementing Mobile Application Management
Secure enterprise data on mobile devices with app-level controls.