Guide · Agent skill
How to use the GitHub Actions Hardening agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The GitHub Actions Hardening skill is an add-on for an AI coding agent that reviews your GitHub Actions workflow files (the YAML in .github/workflows) for security problems. It is aimed at developers and maintainers who want to audit or harden CI, teams writing new workflows, and open-source maintainers who accept pull requests from outside contributors. After this guide you will know what the skill does, how to install it, how to ask for a review, and what its limits are.
GitHub Actions Hardeninggithub/awesome-copilot · MIT Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page.
- 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ inside your project.
- 3Or upload in the Claude apps. Go to Settings → Capabilities → Skills and upload the ZIP.
- 4Make a review request. Ask something like 'review .github/workflows/ci.yml for security issues'.
- 5Read the summary table. Check counts by severity, then read each grouped finding.
- 6Verify and apply fixes yourself. Review each before-and-after fix and apply the ones you agree with.
What is an agent skill, and what does this one make the agent do?
An agent skill is a folder containing a SKILL.md file and supporting reference files. When it is installed, the agent reads these instructions and uses them when your request matches the skill's description.
This skill makes the agent review GitHub Actions workflows with an Actions-specific threat model. It looks for untrusted text pasted into shell commands through ${{ }} expressions, privileged triggers such as pull_request_target and workflow_run that run code from forks, unpinned third-party actions, over-broad GITHUB_TOKEN permissions, and secret or output handling mistakes. General code linters often miss these because the risky part is the YAML and how GitHub expands expressions before the shell runs.
- Script injection via ${{ }} interpolation
- pull_request_target and workflow_run privilege escalation
- SHA-pinning of third-party actions
- Least-privilege permissions and GITHUB_TOKEN scope
- GITHUB_ENV and GITHUB_OUTPUT injection, secret exposure, OIDC instead of long-lived credentials, self-hosted runners on public repositories
Install the GitHub Actions Hardening skill
Download the skill as a ZIP from the skill's page in this directory, then choose one of the two install routes below.
For a personal install available in all your projects, unzip the download into ~/.claude/skills/. For a single project, unzip it into the .claude/skills/ folder inside that project so teammates who clone the repository get it too.
If you use the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/
- Project: .claude/skills/ inside your repository
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Ask for a review with natural requests
You do not need a special command. The skill triggers when your request matches its description. Good requests name the workflow file or describe the outcome you want.
Examples that match the skill's trigger phrases include: "is this workflow safe?", "review my CI for security issues", "why is pull_request_target dangerous here?", "pin my actions", and "lock down GITHUB_TOKEN permissions". You can also ask it to write a new workflow with secure defaults.
- Review .github/workflows/triage.yml for security issues and rank them by severity.
- Pin the third-party actions in my workflows to commit SHAs and keep the version as a comment.
- Why is pull_request_target dangerous in this workflow?
- Lock down the permissions in ci.yml so each job gets only what it needs.
What the report looks like and what the agent will not do
The skill produces a severity-ranked report. It starts with a summary table counting findings as CRITICAL, HIGH, MEDIUM, LOW or INFO. Findings are grouped by issue type, quote the offending YAML with its line, explain the risk in plain English, and give a before-and-after fix.
The agent does not apply changes automatically. It presents fixes for you to review. Severity levels are: CRITICAL for token or secret theft or code execution reachable by an outside contributor; HIGH for exploitable supply-chain or scope problems; MEDIUM for risks that depend on conditions; LOW for hardening gaps; INFO for observations that are not vulnerabilities.
- Summary table first, then findings grouped by issue type
- Exact quoted YAML and line location for each finding
- Before-and-after fixes, presented for human review
- Never applies changes automatically
Safety notes: scripts and network
According to the skill's listing, it runs no scripts and uses no network access. It has no listed requirements.
The skill is a reviewer that reasons from guidance. It can miss issues or flag false positives, so treat its report as a checklist to verify, not a guarantee of security. Review any suggested change before committing it.
- Runs scripts: no
- Uses network: no
- Requires: nothing listed
- It does not guarantee security
Tips for better results
Point the agent at specific files and say whether the repository is public, because the risk of pull_request_target and self-hosted runners depends on who can open pull requests. Ask for one concern at a time if you want a deep dive, for example OIDC setup or pinning.
The skill is specific to GitHub Actions. For Jenkins or GitLab pipelines it is the wrong tool.
- Name the workflow file and whether outside contributors can open PRs.
- Ask for a deep dive on one area such as injection or permissions.
- Use it for GitHub Actions only, not Jenkins or GitLab.
What people use it for
- Auditing an existing repository's CI workflows for script injection from issue titles or PR bodies.
- Checking whether a pull_request_target workflow checks out and runs fork code.
- Pinning third-party actions to full commit SHAs with the version noted in a comment.
- Restricting GITHUB_TOKEN with a top-level permissions block and per-job grants.
- Writing a new workflow with secure defaults before a team adopts it.
Frequently asked questions
Is the GitHub Actions Hardening skill free?
The skill is listed under the MIT licence. The source does not state any price, so check this directory page for current availability.
What do I need to run it?
The listing states no requirements, runs no scripts and uses no network access. You need an agent environment that supports skills, plus your GitHub workflow files.
Where do I install it?
Unzip the ZIP into ~/.claude/skills/ for personal use or into .claude/skills/ in a project. In the Claude apps you can upload it under Settings → Capabilities → Skills.
Does it fix my workflows automatically?
No. The agent presents before-and-after fixes for human review and does not apply changes automatically.
Can it replace a full security audit?
No. It is a reviewer that reasons from guidance, so it can miss issues or flag false positives. Use it alongside your own review.
Does it work for Jenkins or GitLab?
No. The guidance is specific to GitHub Actions, so use a tool built for your CI system for other platforms.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you maintain GitHub Actions workflows, want a severity-ranked review, or accept pull requests from outside contributors and need to check privileged triggers. Skip it if you run Jenkins, GitLab or another non-GitHub CI, or if you expect a guarantee of security rather than a checklist to verify.
Download the skill