gha-security-review

SUSPICIOUS. The skill’s stated purpose is coherent, but it equips an AI agent with offensive GitHub Actions security-review capability while also instructing it to read attacker-controlled repo instruction/config files and granting Bash/Task execution. No direct malware, exfiltration, or supply-chain installer is present, but the combination of exploit-focused guidance plus prompt-injection exposure makes it a high-risk security skill.

No direct indicators of embedded malware are present in this fragment; it is a descriptive set of GitHub Actions workflow snippets and mitigations. However, the illustrated workflow design—triggering privileged CI/CD actions based solely on untrusted `issue_comment` content without strict `author_association` gating, especially when combined with checkout-and-execute of PR/fork code—represents a high-risk CI/workflow abuse vector that can lead to unauthorized operational changes and execution of attacker-controlled code in the CI environment. Applying strict commenter allowlists and avoiding unsafe use of comment content in command/expression contexts is essential.

No direct malware payload is present in this snippet; however, it demonstrates a high-risk CI design where an AI coding agent can be driven by attacker-controlled repository instruction files from forked PRs. Because pull_request_target runs with base-repo privileges and the workflow grants contents: write and pull-requests: write, a successful prompt-injection/instruction-poisoning attack could lead to unauthorized commits and/or PR manipulation. Mitigate by using pull_request with read-only permissions, restricting agent tools/actions, and requiring human review for changes to AI instruction/config files.