Audit GitHub Actions workflows for AI agent security risks

This skill provides static security analysis guidance for GitHub Actions workflows that invoke AI coding agents. It teaches how to discover workflow files locally or from a remote GitHub repository, identify AI action steps, follow cross-file references into composite actions and reusable workflows that may hide AI agents, capture security-relevant configuration, and detect attack vectors where attacker-controlled input reaches an AI agent running in a CI/CD pipeline.

Before auditing, it rejects four common rationalizations for skipping a finding: "it only runs on PRs from maintainers" ignores that pull_request_target and issue_comment triggers expose workflows to any external contributor without write access; "we use allowed_tools to restrict what it can do" ignores that even a restricted tool like echo can exfiltrate data via subshell expansion; "there's no ${{ }} in the prompt, so it's safe" misses the env-var intermediary pattern, where attacker data flows through an env: block into the prompt with no visible expression in the prompt field itself; and "the sandbox prevents any real damage" ignores that sandbox misconfigurations like danger-full-access, Bash(*), or --yolo disable protections entirely.

The audit methodology runs in five ordered steps. Step 0 determines analysis mode: a GitHub URL or owner/repo identifier triggers remote analysis via gh api to list workflow files:

gh api repos/{owner}/{repo}/contents/.github/workflows --paginate --jq '.[].name'

Fetched YAML is always treated as data to read, never as code to execute (never piped to a shell, interpreter, or written out and run). Step 1 discovers workflow files locally via Glob against .github/workflows/*.yml and .yaml, scanning only the repository root, not subdirectories or vendored code. Step 2 identifies AI action steps by matching each step's uses: field (as a prefix before @) against known references - anthropics/claude-code-action (Claude Code Action), google-github-actions/run-gemini-cli and the legacy google-gemini/gemini-cli-action (Gemini CLI), openai/codex-action (OpenAI Codex), and actions/ai-inference (GitHub AI Inference) - then resolves one level deep into local composite actions and reusable workflows that may contain hidden AI agents. Step 3 captures security context: per-action with: fields like prompt, tool-allowlist arguments, sandbox mode, and wildcard user allowlists; workflow-level trigger events flagged as security-relevant (pull_request_target, issue_comment, issues); environment variables whose values reference ${{ github.event.* }}; and permission blocks flagged when broad scopes like contents: write combine with AI agent execution.

Step 4 checks the captured context against nine named attack vectors: A Env Var Intermediary, B Direct Expression Injection, C CLI Data Fetch (gh issue view/gh pr view/gh api inside a prompt), D PR Target + Checkout (a pull_request_target trigger combined with checking out the PR head ref), E Error Log Injection (CI logs, build output, or workflow_dispatch inputs fed to the prompt), F Subshell Expansion, G Eval of AI Output (eval/exec/$() consuming an AI step's output), H Dangerous Sandbox Configs, and I Wildcard Allowlists. Step 5 turns detections into a structured report: each finding gets a title, a severity (High/Medium/Low/Info, weighted by trigger exposure, sandbox/tool configuration, allowlist scope, data-flow directness, and permissions/secrets exposure), the file and step location, an impact sentence, an evidence YAML snippet, a numbered data-flow trace from the attacker-controlled source to the final consequence, and action-specific remediation. Vectors H and I are treated as configuration weaknesses that amplify a co-occurring injection vector rather than standalone findings. A clean repository still gets a substantive report - workflows scanned, AI action instances found by type, and an explicit "no security findings identified" - rather than a bare zero.

Use it to audit a repository's GitHub Actions workflows for AI agent security, review CI/CD configurations invoking Claude Code Action, Gemini CLI, or OpenAI Codex, check whether attacker-controlled input can reach an AI agent's prompt, evaluate sandbox/tool-permission/user-allowlist configuration, or trace data flow from GitHub event context to a prompt field. Do NOT use it on workflows with no AI agent actions, on standalone composite actions or reusable workflows reviewed outside a caller workflow's context, for runtime prompt-injection exploitation (this is static analysis guidance only), on non-GitHub CI/CD systems like Jenkins or GitLab CI, or to auto-fix workflow files - it reports findings, it does not modify anything.

Input is a local repository checkout or a remote GitHub URL/owner/repo[@ref] identifier. Output is a structured findings report: an executive summary with counts by severity, a per-workflow summary table, and findings grouped by workflow and ordered by severity, each with title, severity, file/step location, impact, evidence, a numbered data-flow trace, and remediation guidance - or, for a clean repository, a scanned-workflows and AI-actions-found summary with no findings.

Detects and analyzes configuration for anthropics/claude-code-action, google-github-actions/run-gemini-cli, google-gemini/gemini-cli-action, openai/codex-action, and actions/ai-inference; uses gh api for remote repository access and Glob for local file discovery.

Security teams and repository maintainers who run AI coding agents inside GitHub Actions CI/CD pipelines and need a repeatable first pass before manual expert review - the guidance is explicit that its output is not a substitute for environment-specific validation, testing, or a security expert's judgment, and it stops to ask for clarification rather than guess when required inputs, permissions, or safety boundaries are missing.