agentic-actions-auditor
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.
npx skills add trailofbits/skills --skill agentic-actions-auditor --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Static security analysis guidance for GitHub Actions workflows that invoke AI coding agents. It teaches how to discover workflow files locally or from remote GitHub repositories, identify AI action steps, follow cross-file references to composite actions and reusable workflows that may contain hidden AI agents, capture security-relevant configuration, and detect attack vectors where attacker-controlled input reaches an AI agent running in a CI/CD pipeline.
How it works
- Detect analysis mode (local vs. remote) based on repository URL or identifier.
- Discover workflow files by globbing ".github/workflows/.yml" and ".github/workflows/.yaml" at the repository root.
- Read each discovered workflow file and identify steps with a uses: reference that matches known AI actions (anthropics/claude-code-action, google-github-actions/run-gemini-cli, google-gemini/gemini-cli-action, openai/codex-action, actions/ai-inference).
- Record per-matched step: workflow file path, job name, step name or id, full uses: value, and action type.
- If no AI action steps are found, report accordingly.
- For each AI action step, capture Step-Level Configuration specifics (prompt, claude_args, allowed_non_write_users, allowed_bots, settings, trigger_phrase for Claude; prompt, settings, gemini_model, extensions for Gemini CLI; prompt, prompt-file, sandbox, safety-strategy, allow-users, allow-bots, codex-args for Codex; prompt, model, token for AI Inference).
- Capture Workflow-Level Context (trigger events, env blocks, permissions).
- Produce a Summary Output listing counts of AI action instances by type.
- Analyze for attack vectors by consulting foundational references and applying detection heuristics to the captured security context.
When to use it
- Auditing a repository's GitHub Actions workflows for AI agent security
- Reviewing CI/CD configurations that invoke Claude Code Action, Gemini CLI, or OpenAI Codex
- Checking whether attacker-controlled input can reach AI agent prompts
- Evaluating agentic action configurations (sandbox settings, tool permissions, user allowlists)
- Assessing trigger events that expose workflows to external input
- Investigating data flow from GitHub event context through env blocks to AI prompt fields
What it can touch
- Tools: Read, Grep, Glob, Bash
- It analyzes workflow files locally in the repository and uses Glob to locate workflow files, then reads contents to identify AI action steps and their configurations.
Caveats
- This is static analysis guidance and does not perform runtime testing or exploitation.
- It reports findings but does not modify any workflow files.
- It relies on the presence and correctness of workflow files and their uses: references to known AI actions; nested or cross-file references are resolved only one level deep.
# Agentic Actions Auditor Static security analysis guidance for GitHub Actions workflows that invoke AI coding agents. This skill teaches you how to discover workflow files locally or from remote GitHub repositories, identify AI action steps, follow cross-file references to composite actions and reusable workflows that may contain hidden AI agents, capture security-relevant configuration, and detect attack vectors where attacker-controlled input reaches an AI agent running in a CI/CD pipeline. ## When to Use - Auditing a repository's GitHub Actions workflows for AI agent security - Reviewing CI/CD configurations that invoke Claude Code Action, Gemini CLI, or OpenAI Codex - Checking whether attacker-controlled input can reach AI agent prompts - Evaluating agentic action configurations (sandbox settings, tool permissions, user allowlists) - Assessing trigger events that expose workflows to external input (`pull_request_target`, `issue_comment`, etc.) - Investigating data flow from GitHub event context through `env:` blocks to AI prompt fields ## When NOT to Use - Analyzing workflows that do NOT use any AI agent actions (use general Actions security tools instead) - Reviewing standalo
- When to Use
- When NOT to Use
- Rationalizations to Reject
- Audit Methodology
- Step 0: Determine Analysis Mode
- Step 1: Discover Workflow Files
- Step 2: Identify AI Action Steps
- Step 3: Capture Security Context
- Step 4: Analyze for Attack Vectors
- Step 5: Report Findings
- Detailed References
What does the agentic-actions-auditor skill do?
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.
How do I install it?
Run `npx skills add trailofbits/skills --skill agentic-actions-auditor --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.