gha-security-review
Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it.
Profile →npx skills add sickn33/agentic-awesome-skills --skill gha-security-review --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
<!-- Attack patterns and real-world examples sourced from the HackerBot Claw campaign analysis by StepSecurity (2025): https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation --> # GitHub Actions Security Review Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it. This skill encodes attack patterns from real GitHub Actions exploits — not generic CI/CD theory. ## When to Use - You are reviewing GitHub Actions workflows for exploitable security issues. - The task requires tracing a concrete attack path from an external attacker to workflow execution or secret exposure. - You need a security review of workflow files, composite actions, or workflow-related scripts with evidence-based findings only. ## Scope Review the workflows provided (file, diff, or repo). Research the codebase as needed to trace complete attack paths before reporting. ### Files to Review - `.github/workflows/*.yml` — all workflow definitions - `action.yml` / `action.yaml` — composite actions in the repo - `.github/actions/*/action.yml` — local reusable actions - Config files loa
- When to Use
- Scope
- Files to Review
- Out of Scope
- Threat Model
- Confidence
- Step 1: Classify Triggers and Load References
- Step 2: Check for Vulnerability Classes
- Check 1: Pwn Request
- Check 2: Expression Injection
- Check 3: Unauthorized Command Execution
- Check 4: Credential Escalation
- Check 5: Config File Poisoning
- Check 6: Supply Chain
What does the gha-security-review skill do?
Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it.
How do I install it?
Run `npx skills add sickn33/agentic-awesome-skills --skill gha-security-review --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From sickn33/agentic-awesome-skills, a repository with 44,414 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.