pip install red-specter-pipeline
Modern CI/CD pipelines have write access to production. They hold your cloud credentials, your secrets, your deployment keys. A single misconfigured workflow — one unverified fork PR, one unpinned Action — is a full production compromise. PIPELINE maps every attack surface and exploits it.
The most dangerous GitHub Actions misconfiguration. Workflows using pull_request_target run in the base branch context — with GITHUB_TOKEN write permissions — even for fork PRs. Combined with PR head checkout: full repository write access from an external contributor.
Clinejection (Feb 2026): a novel attack class targeting Cline, GitHub Copilot Review, CodeRabbit. PR titles, descriptions, and commit messages hijack AI reviewer behaviour. The reviewer approves what the payload tells it to approve.
When pull_request_target workflows cache dependencies, fork PRs can poison shared build caches consumed by privileged CI runs. A fork PR that poisons the cache contaminates every subsequent build in the repository.
uses: actions/checkout@v3 pins nothing. Tag v3 can be moved to any commit. Typosquatted Actions detected via SequenceMatcher similarity analysis sit in the marketplace waiting. One compromised Action in your workflow is a full CI compromise.
Workflows with id-token: write can generate short-lived OIDC tokens for AWS, GCP, or Azure authentication. A compromised workflow with OIDC access is a direct path to production infrastructure — no long-lived credential needed.
Hardcoded AWS keys, GitHub PATs, GitLab tokens, private keys, Slack tokens — all scanned. Secrets exposed to fork PR workflows via environment variables, artifact uploads, or debug logging are exfiltrable with no code execution required.
Eight subsystems. Each one attacks a distinct CI/CD surface — from workflow misconfiguration enumeration to AI bot prompt injection to OIDC cloud pivot. Three clearance levels: STANDARD (always available), FORGE (UNLEASHED key required), and --confirm-destroy (explicit destructive confirmation required).
| # | Subsystem | Clearance | What It Does |
|---|---|---|---|
| 01 | SCAN | STANDARD | Pipeline enumeration. Detects pull_request_target privilege escalation, self-hosted runner exposure, over-permissioned GITHUB_TOKEN, workflow_dispatch misconfigurations, secret scope leakage. |
| 02 | SECRETS_HUNT | FORGE | Credential discovery. Scans for AWS keys, GitHub PATs, GitLab tokens, private keys, Slack tokens. Flags secrets exposed to fork PRs and credential files in artifact uploads. |
| 03 | ACTION_POISON | FORGE | GitHub Action supply chain analysis. Detects unpinned Actions using floating tags (@v3, @main). Identifies typosquatted Actions via SequenceMatcher similarity analysis. |
| 04 | INJECT | FORGE | Clinejection-class AI bot prompt injection. 7 payloads across PR titles, descriptions, commit messages, issue bodies to redirect AI reviewer behaviour. Targets Cline, Copilot Review, CodeRabbit. |
| 05 | CACHE_POISON | FORGE | Cache poisoning attack surface analysis. Targets pull_request_target + cache combinations. Detects insecure cache keys using mutable references (github.head_ref). |
| 06 | PIVOT | FORGE | Cloud lateral movement from CI/CD. Detects OIDC token paths to AWS, GCP, Azure. Maps Kubernetes access via kubectl. Generates exploitation walkthroughs per provider. |
| 07 | PERSIST | --confirm-destroy | CI/CD persistence via Actions backdoor, webhook injection, protected branch bypass, and deployment environment manipulation. |
| 08 | REPORT | STANDARD | WARLORD-compatible JSON. MITRE ATT&CK mapping (T1195, T1059, T1552). CVE references. Per-finding CVSS, remediation guidance. |
Enumerate, inject, pivot — one command against any GitHub Actions repository:
PIPELINE slots into the NIGHTFALL offensive framework as the dedicated CI/CD and supply chain attack engine. Findings feed directly into WARLORD for campaign management and AI Shield for runtime blocking rules.
Red Specter PIPELINE is intended for authorised security testing only. Unauthorised use against CI/CD pipelines, repositories, or cloud infrastructure you do not own or have explicit written permission to test may violate the Computer Misuse Act 1990 (UK), Computer Fraud and Abuse Act (US), and equivalent legislation in other jurisdictions. The PERSIST subsystem requires explicit --confirm-destroy confirmation and must only be used under the terms of a signed authorisation agreement. Apache License 2.0.