> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Pipeline Definition (PD)

- URL: /taxonomies/software-factory/pipeline-definition/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T13:05:11.679Z
- Description: Pipeline Definition (PD): 13 threats, software factory taxonomy. Workflow files, triggers, expressions, reusable workflows, third-party actions and plugins.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Software factory](/taxonomies/software-factory/) › Pipeline Definition

**Station 03 of 17 · Line 1, Source to Artifact · 13 threats · prefix PD**

A pipeline definition is code that runs with more privilege than the people who edit it. These cards cover workflow files, triggers, expressions, reusable templates, and the third-party actions, orbs and plugins they call.

**Scope:** Workflow files, triggers, expressions, reusable workflows, third-party actions and plugins.

![Table: Pipeline Definition (PD), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/106/taxonomy-table-03-PD.png =1400x4438)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/software-factory/) on the overview page, where it can be searched and copied.*

## The threats

- <span id="pd-a"></span>**PD·A** Poisoned Pipeline Execution
- <span id="pd-k"></span>**PD·K** Privileged Trigger on Untrusted Input
- <span id="pd-q"></span>**PD·Q** Expression Injection
- <span id="pd-j"></span>**PD·J** Unpinned Third-Party Step
- <span id="pd-10"></span>**PD·10** Transitive Step Dependency
- <span id="pd-9"></span>**PD·9** Remote Script Execution
- <span id="pd-8"></span>**PD·8** Insufficient Flow Control
- <span id="pd-7"></span>**PD·7** Environment Tampering Between Steps
- <span id="pd-6"></span>**PD·6** Shared Template Blast Radius
- <span id="pd-5"></span>**PD·5** Parameter Injection
- <span id="pd-4"></span>**PD·4** Comment and Bot Triggers
- <span id="pd-3"></span>**PD·3** Conditional Skip
- <span id="pd-2"></span>**PD·2** Definition Drift

## Where this station touches others

- **Pipeline Definition and Runners:** the definition is what the pipeline is told to do; the runner is where it executes and what survives between jobs.

## Seen in the wild

- **PD·A Poisoned Pipeline Execution:** OWASP CICD-SEC-4; Trivy pull_request_target (2026).
- **PD·K Privileged Trigger on Untrusted Input:** Trivy pull_request_target (2026).
- **PD·Q Expression Injection:** Ultralytics branch-name injection (2024).
- **PD·J Unpinned Third-Party Step:** tj-actions (2025); trivy-action (2026).
- **PD·10 Transitive Step Dependency:** reviewdog to tj-actions chain, link likely (2025).
- **PD·9 Remote Script Execution:** Codecov Bash Uploader (2021).
- **PD·8 Insufficient Flow Control:** OWASP CICD-SEC-1; Amazon Q Developer extension (2025).
- **PD·4 Comment and Bot Triggers:** hackerbot-claw campaign (2026).

Sources for each case are listed on the [overview page](/taxonomies/software-factory/).

## STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 9 cleanly and 4 only loosely. CAPEC 3.9 has a pattern that describes 3 of them directly, only a generic parent pattern for 9, and nothing for 1. CWE 4.20 names the weakness directly for 10, has only a broader weakness for 2, and nothing for 1. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE](/mapping-the-software-factory-threat-taxonomy/). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for Pipeline Definition (PD), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/106/software-factory-mapping-table-03-PD.png =1400x2165)

---

← [Version Control (VC)](/taxonomies/software-factory/version-control/) · [Software factory overview](/taxonomies/software-factory/) · [Runners (RN)](/taxonomies/software-factory/runners/) →

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [software factory overview](/taxonomies/software-factory/).*