github-actions-hardening
Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and over-scoped tokens. Use this skill when asked to review, audit, harden, or secure a GitHub Actions workflow, when writing a new workflow, or for any request like "is this workflow safe?", "review my CI for security issues", "why is pull_request_target dangerous here?", "pin my actions", or "lock down GITHUB_TOKEN
Profile →npx skills add github/awesome-copilot --skill github-actions-hardening --agent copilot
Same command for any agent — swap --agent for claude-code, codex, cursor.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# GitHub Actions Hardening A focused security reviewer for GitHub Actions workflows. It reasons about the *Actions-specific* threat model — where trust boundaries live in trigger types, token scopes, and string interpolation — rather than the application-code vulnerabilities a general security scanner looks for. Most workflow risks are invisible to language linters because the dangerous code is the YAML itself and the way GitHub expands `${{ }}` expressions into a shell before your script runs. ## When to Use This Skill Use this skill when the request involves: * Reviewing, auditing, or hardening any file under `.github/workflows/` * Authoring a new workflow and wanting it secure by default * A workflow that uses `pull_request_target`, `workflow_run`, or `issue_comment` triggers * Questions about `GITHUB_TOKEN` permissions or the `permissions:` key * Pinning actions to commit SHAs vs tags vs branches * Handling untrusted input (issue titles, PR bodies, branch names, commit messages) in `run:` steps * OIDC / cloud authentication from Actions, or secret handling in CI * Self-hosted runners on public repositories * Any request like "is this workflow safe?", "secure my CI", or "review
- When to Use This Skill
- The Core Insight
- Execution Workflow
- Step 1 — Map the Triggers and Trust Level
- Step 2 — Hunt for Script Injection
- Step 3 — Check Privileged Triggers Don't Execute Untrusted Code
- Step 4 — Audit permissions:
- Step 5 — Audit Action References (Supply Chain)
- Step 6 — Check Secret and Output Handling
- Step 7 — Produce the Report
- Severity Guide
- Output Rules
- Reference Files
What does the github-actions-hardening skill do?
Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and over-scoped tokens. Use this skill when asked to review, audit, harden, or secure a GitHub Actions workflow, when writing a new workflow, or for any request like "is this workflow safe?", "review my CI for security issues", "why is pull_request_target dangerous here?", "pin my actions", or "lock down GITHUB_TOKEN
How do I install it?
Run `npx skills add github/awesome-copilot --skill github-actions-hardening --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From github/awesome-copilot, a repository with 37,432 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.