gha-security-review
Installation
SKILL.md
gha-security-review
Overview
GitHub Actions workflows (.github/workflows/) are executable code with the same blast radius as production. A pull_request_target trigger with ${{ github.event.pull_request.title }} interpolation is a remote code execution waiting to happen. This skill audits workflows as code, not as config — every finding answers "what exact input would the attacker control and what execution primitive do they reach".
This is the CI/CD-layer counterpart to:
| Layer | Skill | Focus |
|---|---|---|
| Application code | security-and-hardening |
input validation, auth, OWASP, secrets-in-source |
| Supply chain + deploy | security-devsecops |
deps, SBOM, secrets rotation, IaC, container, pre-deploy |
| CI/CD workflows | gha-security-review (this skill) |
.github/workflows/ action misuse, injection, token leakage |
| Production monitor + incident | observability-and-instrumentation + security-incident-response |
runtime visibility + post-incident response |
OMO integration: this skill pairs with oracle agent for "is this permissions: block actually minimal?" judgment calls, and grep_app MCP for hunting known-bad action patterns across GitHub.