gha-security-review
Installation
SKILL.md
GHA Security Review
Review GitHub Actions workflows like an attacker would. Only report issues that can be reached from a realistic external trigger.
When to Use
- Reviewing
.github/workflows/*.ymlor.github/workflows/*.yamlchanges before merge - Auditing a repository that runs PR, issue comment, or reusable workflow automation
- Checking whether workflow files expose secrets, write tokens, or command execution
- Investigating CI/CD compromise paths involving fork PRs or untrusted workflow inputs
When NOT to Use
| Instead of gha-security-review | Use |
|---|---|
| Broad application security review | security-scan |
| General repository trust scorecard | evaluate-repository |
| Threat modeling a system architecture | threat-model-analyst |