{{ message }}
Repository navigation
feat(cicd): add offensive-claude-code-action - #37
Open
sushant-me wants to merge 1 commit into
Open
sushant-me wants to merge 1 commit into
sushant-me wants to merge 1 commit into
Conversation
Adds Skills/cicd/offensive-claude-code-action/SKILL.md — methodology for assessing AI coding agents wired into CI (anthropics/claude-code-action and the Codex/Gemini/Copilot equivalents). The existing offensive-cicd-pipeline skill covers attacker text reaching a shell. This covers attacker text reaching a model that then decides whether to produce the shell command, which is a different surface with different controls: the action's guardrail prompt and the tool allowlist sit in the way, and the highest-value injection vectors are context files (CLAUDE.md, AGENTS.md) that the agent loads by design rather than text smuggled past a filter. Contents: recon of agent workflows and their permissions block; the attacker-controlled text surfaces and who can reach each; per-framing injection shapes and an execution-marker technique for reproducible proof; tool-allowlist abuse for Bash/Write/WebFetch/Read; pull_request_target with an untrusted checkout; exfiltration through the agent's own reply, commits and PRs; repository persistence by rewriting .github/workflows; OIDC trust-policy abuse; MCP tool poisoning; denial-of-wallet; a defender view; and a ten-point hardening checklist to verify rather than assume. README updated (CI/CD count 2 -> 3, skill table) and CHANGELOG under [Unreleased]. Note the manifest regeneration also registers offensive-netexec, which exists in the tree on main but was absent from both claude-skills.json and the README — see the PR description.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
Skills/cicd/offensive-claude-code-action/SKILL.md— 393 lines, frontmatternamematching the folder, description 209 words.Why a new skill rather than an edit
offensive-cicd-pipelinecovers attacker text reaching a shell (expression injection intorun:blocks,workflow_runabuse,GITHUB_TOKENover-scoping). This covers attacker text reaching a model that then decides whether to produce the shell command. The controls are different — the action's guardrail prompt and its tool allowlist sit between you and execution — and so are the highest-value vectors: the context files (CLAUDE.md,AGENTS.md,.cursorrules) an agent loads by design are a cleaner injection path than smuggling instructions past a filter, and they need no injection framing at all.Contents
pull_request_targetCODEOWNERS, branch protection, release automationid-token: writeagainst a loosely scoped cloud trust policyEvery code block is language-tagged, there are no emoji, and the checklist framing ("verify, not assume") is deliberate — most of these controls are commonly claimed and rarely checked.
Deliberately not included
I did not write specific
AML.T####ATLAS identifiers. I am not confident enough in the exact numbers to put them in a skill others will quote, and a wrong technique ID is worse than an omitted one. The skill points at the ATLAS matrix and says so explicitly. OWASP entries are given as LLM01:2025 / LLM06:2025 with a note that the IDs moved between the 2023 and 2025 editions, since reports citing the older numbering will otherwise disagree.One thing to look at: a stale manifest on
mainpython3 tools/build_manifest.py(the documented step) registersoffensive-netexec, which exists atSkills/active-directory/offensive-netexec/onmainbut was absent fromclaude-skills.json— itsskill_countwas 78, now 80 with my skill. It is also not listed in the README's active-directory table.So the manifest change in this PR is two skills, not one:
offensive-claude-code-action(this PR)offensive-netexec(pre-existing omission, picked up by the generator)I kept the generated output rather than hand-editing it to exclude
offensive-netexec, because hand-editing a generated file means the next person to run the generator sees an unexplained diff. Happy to split theoffensive-netexecregistration into its own PR, or to add its missing README row, if you would rather keep this one to a single concern — say which and I will redo it.Verification
namematches the folder (offensive-claude-code-action); description is 209 words, within the stated 50–500.[Unreleased].tools/build_manifest.pyrun;claude-skills.jsonregenerated.CONTRIBUTING.mdmentions./tools/check-skill.sh, but that script is not intools/onmain(onlybuild_manifest.py), so I could not run it. If it lives somewhere else, point me at it and I will run it.