Technique · Static analysis

CI workflow linting

Checks CI definitions themselves: syntax, script injection through untrusted inputs, over-broad token permissions, unpinned actions.

Sub-techniques

Workflow syntax V1009.001

Validate workflow files and embedded shell before they run.
Workflow security audit V1009.002

Flag template injection, pull_request_target misuse, unpinned third-party actions and write-all permissions.