Detect Azure Pipelines YAML steps that pass untrusted template parameters, runtime variables, or queue-time inputs into script-capable tasks and inline script blocks in ways that can enable command injection. Report exact locations, the interpolation source, the execution surface, and remediation guidance without modifying files.
Detect Azure Pipelines YAML steps that pass untrusted template parameters, runtime variables, or queue-time inputs into script-capable tasks and inline script blocks in ways that can enable command injection. Report exact locations, the interpolation source, the execution surface, and remediation guidance without modifying files.
Installation
bash
# Install from registry
codemod run @codemod/azure-pipelines-script-injection-audit
# Or run locally
codemod run -w workflow.yaml
Usage
This codemod is read-only. It audits Azure Pipelines YAML for inline script and script-capable task fields that interpolate template parameters, runtime variables, variable-group values, or other externally influenced expressions into shell-executed content.
It scans:
azure-pipelines.yml and azure-pipelines.yaml
YAML under .azure-pipelines/, pipelines/, and .ado/
Referenced template: and extends: YAML files inside the target repo
It reports findings for:
Inline step keys: script, bash, pwsh, powershell
Script-capable tasks such as Bash, PowerShell, AzureCLI, CmdLine, BatchScript, ShellScript, PythonScript, and PowerShellOnTargetMachines
Task inputs that execute inline shell text or pass arguments into shell-capable tasks
It does not rewrite source files. Findings are emitted as structured runtime warnings and metrics, including:
azure_pipelines_script_injection_finding
azure_pipelines_script_injection_by_surface
azure_pipelines_script_injection_by_source_kind
azure_pipelines_script_injection_by_task_family
azure_pipelines_script_injection_by_confidence
Each finding carries CWE-20, CWE-78, YAML location data, execution surface, source kind, template chain, and remediation guidance.
Detection Notes
Inline script interpolation is treated as suspicious by default, including quoted interpolation.
env: assignments are not reported by themselves.
Non-script task fields such as UsePythonVersion.inputs.versionSpec are excluded.
Script file path references such as filePath are excluded unless shell-executed arguments are also interpolated.
Simple template pass-through is resolved for in-repo template: and extends: chains.
Development
bash
# Test the read-only audit and metrics snapshots
pnpm test
# Validate the workflow
codemod workflow validate -w workflow.yaml
# Refresh expected snapshots while authoring
pnpm test:update
# Publish to registry
codemod login
codemod publish
License
MIT
Ready to evolve your codebase?
Build tailored, compiler-aware skills to assess, plan, and automate complex codebase changes.