Skip to content
Get packs

Agentic Actions Auditor

Audits GitHub Actions workflows for security flaws where untrusted input reaches AI coding agents.

Source Download skill
Repository
sickn33/agentic-awesome-skills
Stars
49,023
Licence
MIT
Files
1 file

What it does

When installed, the agent gains a structured methodology for reviewing GitHub Actions CI/CD workflows that run AI coding agents such as Claude Code Action, Gemini CLI, OpenAI Codex, or GitHub AI Inference. It teaches the agent to find these AI steps, follow references to composite actions and reusable workflows, and look for paths where attacker-controlled input (like issue text or pull request data passed through environment variables) can reach the AI's prompt or tools. It produces a findings report and does not modify files.

Great for

  • Maintainers of open-source repositories that run AI agents on pull requests or issues
  • Security reviewers checking CI/CD configurations before enabling an AI agent workflow
  • Teams auditing workflows that use pull_request_target or issue_comment triggers with AI actions

Skip it if

  • Repositories with no AI agent actions, since general Actions security tools fit better
  • Non-GitHub CI systems such as Jenkins, GitLab CI or CircleCI, which the skill explicitly excludes
  • Runtime prompt injection testing: the skill is static analysis guidance and does not exploit anything

Try asking

  • “Audit the workflows in owner/repo for prompt injection risks in AI agent steps”
  • “Check whether my pull_request_target workflow using Claude Code Action can be triggered by outside contributors”
  • “Review this repo's CI configuration for dangerous sandbox or tool permission settings on Gemini CLI”
Step-by-step guide: how to use Agentic Actions AuditorInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    agentic-actions-auditor.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip agentic-actions-auditor.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip agentic-actions-auditor.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Point it at a specific ref (owner/repo@sha) so every fetch analyzes the same code version
  • Note that the bundled file says supporting reference files are missing, so findings rely only on the inline checks and unverified action-version details should be checked manually
  • Use it alongside human review, since static guidance can miss vectors and the skill itself warns against trusting a clean-looking YAML

What's inside

  • SKILL.md

Redistributed unmodified from sickn33/agentic-awesome-skills under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.