Scan Azure Pipelines YAML pipelines for task and script invocations that interpolate untrusted parameters or variables into command/task inputs in ways that can enable parameter or command injection, and report precise findings with security-oriented remediation guidance and metrics.
Read-only mining codemod for Azure Pipelines YAML that detects task and script surfaces where dynamic pipeline expressions are interpolated into shell-executed command strings or forwarded argument fields.
What It Detects
Top-level script-bearing steps such as script, bash, pwsh, and powershell
Task inputs such as script, inlineScript, Inline, InlineScript, arguments, ScriptArguments, command, commandOptions, options, arg, args, and targetArguments
Template expressions ${{ ... }}, macros $(...), runtime expressions $[ ... ], and simple locally derived variables that later flow into sensitive sinks
Risk context for inline script bodies, argument strings, command-option fields, and derived-variable cases
What It Excludes
Non-executable metadata such as displayName, condition, dependsOn, pool settings, and similar declarative fields
Literal-only values with no dynamic expressions
Standalone env: mappings that are not consumed in the same command sink
Parameter declarations or variable declarations by themselves unless a sensitive sink consumes the derived value
Direct allowlisted parameter usage when the parameter declaration has explicit values: enumeration and the expression is used as a standalone token
Reporting
This codemod does not rewrite source files.
For each finding it emits structured runtime warnings with:
file, line, column, yamlPath, and stepIndex
taskType, taskRef, field, and sinkClass
expressionKind, sourceKind, and risk
Evidence and remediation guidance for parameter and command injection risks, including CWE-20 and CWE-78 mappings
# Run locally against a repository
pnpm dlx codemod@latest workflow run -w . -t /path/to/repo
# Test fixtures
pnpm test
# Validate workflow and package types
pnpm check-types
pnpm dlx codemod@latest workflow validate -w workflow.yaml
Remediation Guidance
Avoid concatenating user-controlled parameters or variables into inline shell bodies.
Prefer task-native structured inputs instead of raw argument strings.
Map parameters through explicit allowlists before use.
Pass arguments as separate validated values where the Azure task supports that shape.
Use fixed command templates instead of forwarding untrusted extra-args strings.
License
MIT
Ready to evolve your codebase?
Build tailored, compiler-aware skills to assess, plan, and automate complex codebase changes.