Audit GitHub Actions workflows for AI agent security risks

This skill provides static security analysis guidance for GitHub Actions workflows that invoke AI coding agents. It teaches how to discover workflow files locally or from a remote GitHub repository, identify AI action steps, and trace whether attacker-controlled input can reach an AI agent's prompt. It covers four action types: Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference.

The methodology runs in five steps. Step 0 determines the analysis mode: a repository URL or owner/repo identifier triggers remote analysis using gh api calls to list and fetch workflow files, with fetched YAML always treated as data to read, never as code to execute; anything else uses local analysis. Step 1 discovers workflow files by globbing the workflows directory at the repository root only, not subdirectories or vendored code. Step 2 identifies AI action steps by matching each step's uses field as a prefix against the known action references, resolving local composite actions and reusable workflow calls one level deep. Step 3 captures security context for each AI action step: prompt-related fields, sandbox and safety-strategy settings, user and bot allowlists, trigger events such as pull_request_target, issue_comment, and issues, environment variables that reference event data, and permissions blocks. Step 4 checks nine attack vectors against that context: an env var intermediary, direct expression injection, CLI data fetch commands in the prompt, a pull_request_target trigger combined with checking out the PR head, error log injection, subshell expansion through restricted tools, evaluating AI output, dangerous sandbox configurations, and wildcard user allowlists. Step 5 reports findings with a title, severity, file and step location, impact, evidence snippet, a numbered data flow trace from the attacker-controlled source to the consequence, and remediation guidance, plus a substantive clean-repo report when nothing is found.

The skill also names four rationalizations to reject during an audit: assuming a workflow is safe because it only runs on maintainer PRs, ignoring that pull_request_target and issue_comment expose it to external input; assuming a tool allowlist makes it safe, when even a restricted command like echo can exfiltrate data through subshell expansion; assuming no template expression in the prompt means it is safe, missing the env-var-intermediary pattern; and assuming a sandbox prevents real damage, when misconfigurations such as danger-full-access or --yolo disable protections.

Use it when auditing a repository's GitHub Actions workflows for AI agent security, reviewing CI/CD configurations that invoke Claude Code Action, Gemini CLI, or OpenAI Codex, checking whether attacker-controlled input can reach an AI prompt, evaluating sandbox settings, tool permissions, and user allowlists, or tracing data flow from event context through env blocks into a prompt field.

Do not use it on workflows that use no AI agent actions, on standalone composite actions outside a caller workflow, for runtime prompt injection testing since this is static guidance rather than exploitation, on non-GitHub CI/CD systems such as Jenkins or GitLab CI, or to auto-fix workflow files, since the skill reports findings and does not modify them.

The input is a local repository or a remote owner/repo reference, optionally with a ref. The output is a structured findings report with an executive summary counting workflows, AI action instances, and findings by severity, a per-workflow summary table, and findings grouped by workflow in descending severity order. Remote analysis adds a header naming the repository and ref, clickable GitHub links to each finding's file, and source attribution.

It relies on the gh command line for remote analysis and Glob and Read for local analysis, restricting Bash strictly to gh api and gh auth status calls and never to executing fetched content. Reference files back the methodology: action security profiles, the shared attacker-controlled input model, one file per detection vector, and the cross-file resolution procedure for composite actions and reusable workflows.

It is for application security engineers, platform teams, and repository maintainers who need to review CI/CD pipelines that call AI coding agents for prompt injection and configuration risks before those risks reach production.