Review GitHub Actions for Exploitable Vulnerabilities

GitHub Actions Security Review is a skill for finding exploitable vulnerabilities in GitHub Actions workflows. Its central rule is that every finding must include a concrete exploitation scenario: if you cannot build the attack, do not report it. It encodes attack patterns from real GitHub Actions exploits, credited to the HackerBot Claw campaign analysis by StepSecurity from 2025, rather than generic CI/CD theory.

The scope is the workflows you provide, as a file, diff or repo, and the skill traces complete attack paths through the codebase before reporting. Files to review are the workflow definitions under .github/workflows, composite action files (action.yml or action.yaml), local reusable actions under .github/actions, and config files that workflows load, such as CLAUDE.md, AGENTS.md, a Makefile and shell scripts under .github. Workflows in other repositories and GitHub App installation permissions are out of scope, though relevant dependencies can be noted.

The threat model covers only an external attacker without write access to the repository, who can open pull requests from forks, create issues and post comments. The workflow works in four steps. Step 1 classifies triggers and loads the matching reference file, for example pull_request_target maps to a pwn-request reference and issue_comment command parsing to a comment-triggered commands reference. Step 2 runs eight checks: pwn request, expression injection, unauthorized command execution, credential escalation, config file poisoning, supply chain, permissions and secrets, and runner infrastructure. Step 3 validates before reporting by reading the full workflow and tracing the trigger, the expression or checkout, attacker control and existing mitigations. Step 4 writes the report.

Use it when reviewing GitHub Actions workflows for exploitable security issues, when you need a concrete attack path from an external attacker to workflow execution or secret exposure, or when you want evidence-based findings only.

Do not flag issues that require write access: workflow_dispatch input injection, expression injection in push-only workflows on protected branches, workflow_call input injection where all callers are internal, and secrets in workflow_dispatch or schedule-only workflows. Safe patterns include pull_request_target without checkout of fork code, numeric values such as the pull request number in run blocks, expressions in if and with fields, actions pinned to a full SHA and the pull_request trigger. If no check produces a finding, report zero findings and do not invent issues.

The input is a workflow file, diff or repository. Confidence is graded: report only HIGH and MEDIUM. A HIGH finding needs five elements: entry point, payload, execution mechanism, impact and a proof-of-concept sketch. If you cannot construct all five, report it as MEDIUM, needs verification. LOW findings are theoretical or mitigated elsewhere and are not reported.

The report is Markdown titled GitHub Actions Security Review, with findings labeled like GHA-001 including workflow file and line, trigger, confidence, exploitation scenario, impact and fix, followed by Needs Verification and Reviewed and Cleared sections. With no findings, the message is that no exploitable vulnerabilities were identified and all workflows were reviewed and cleared.

The skill relies on nine reference files it loads selectively, covering pwn requests, comment-triggered commands, expression injection, credential escalation, AI prompt injection via CI, supply chain, permissions and secrets, runner infrastructure and real-world attacks.

It is for security engineers and maintainers who need a disciplined workflow review that avoids false positives by demanding a working attack path for every finding.