| name | cicd-supply-chain |
| description | Use when attacking or auditing a CI/CD pipeline or software supply chain — pwn requests, poisoned pipeline execution, compromised/mutable-tag actions, dependency confusion, registry worms, runner backdoors, OIDC trust abuse, SLSA/provenance |
| metadata | {"type":"offensive","phase":"weaponize-delivery-exploit","tools":"gato-x, zizmor, octoscan, poutine, raven, trufflehog, gitleaks, cosign, slsa-verifier, gh, glab, syft","mitre":["T1195.001","T1195.002","T1199","T1525","T1556","T1078.004","T1648"]} |
| kill_chain | {"phase":["weaponize","delivery","exploit","actions"],"step":[2,3,4,7],"attck_tactics":["TA0001","TA0003","TA0004","TA0006","TA0008"],"attck_techniques":["T1195","T1195.001","T1195.002","T1199","T1525","T1556","T1078.004","T1648","T1552.004","T1059"]} |
| depends_on | ["recon-osint","vulnerability-analysis"] |
| feeds_into | ["cloud-security","red-team-ops","initial-access"] |
| inputs | ["target_repos","ci_config","registry_namespaces","oidc_trust_policies"] |
| outputs | ["pipeline_finding","exfiltrated_secrets","malicious_artifact","attack_path","provenance_gap"] |
| references | ["references/pipeline-poisoning.md","references/action-dependency-compromise.md","references/package-registry-attacks.md","references/runner-attacks.md","references/secrets-oidc-abuse.md","references/build-integrity-defense.md"] |
| scripts | ["scripts/workflow_auditor.py","scripts/dependency_confusion.py","scripts/oidc_trust_auditor.py","scripts/malicious_action_scanner.py","scripts/runner_recon.sh","scripts/provenance_verify.sh"] |
