agentic-actions-auditor

What it does

Static security analysis guidance for GitHub Actions workflows that invoke AI coding agents. Identifies workflow files that invoke AI actions, traces cross-file references to composite actions and reusable workflows, captures security-relevant configuration, and detects attack vectors where attacker-controlled input reaches an AI agent in a CI/CD pipeline.

How it works

1. Locate workflow files in a repository by scanning for .github/workflows/*.yml and *.yaml at the repository root. If none found, it reports and stops. 2) For each workflow, inspect every job and step, and flag steps where the uses: value matches a known AI action reference (anthropics/claude-code-action, google-github-actions/run-gemini-cli, google-gemini/gemini-cli-action, openai/codex-action, or actions/ai-inference). Record workflow file path, job name, step name or id, the full uses: value, and the action type. 3) For each AI action step, capture step-level configuration from the with: block (e.g., prompt, claude_args, allowed_non_write_users, settings, trigger_phrase for Claude Code Action; prompt, settings, gemini_model, extensions for Gemini CLI; prompt, prompt-file, sandbox, safety-strategy, allow-users, allow-bots, codex-args for Codex; prompt, model, token for AI Inference). Also capture workflow-level context (trigger events, env blocks, permissions). 4) After gathering, produce a summary of AI action instances with counts across action types and include security context for each instance. 5) Analyze each instance against attack vectors and generate findings with evidence and remediation guidance.

When to use

• Auditing a repository's GitHub Actions workflows for AI agent security
• Reviewing CI/CD configurations that invoke Claude Code Action, Gemini CLI, or OpenAI Codex
• Checking whether attacker-controlled input can reach AI agent prompts
• Evaluating agentic action configurations (sandbox settings, tool permissions, user allowlists)
• Assessing trigger events that expose workflows to external input
• Investigating data flow from GitHub event context through env blocks to AI prompt fields

What it can touch

Only analyzes workflow files and their configuration (uses:, with:, env:, on:, permissions:). It references known AI action actions and fields described above. It does not modify files.

Caveats

Static analysis only; does not perform runtime testing or exploitation. It reports findings and does not alter repository contents. It relies on the presence of documented AI action references and field names; unresolved or nested references beyond one level may be logged as not resolved per cross-file resolution rules.