agentic-actions-auditor

Name: agentic-actions-auditor
Availability: InStock
Author: Canhada-Labs

Analyze GitHub Actions workflows invoking AI coding agents for security risks.

2|Updated Jun 30, 2026

Search Tags:#static analysis #security analysis #github actions #github workflows #ai coding agents

Ready to run

npx skills add https://github.com/Canhada-Labs/ceo-orchestration --skill agentic-actions-auditor-canhada-labs

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: agentic-actions-auditor
Source: https://github.com/Canhada-Labs/ceo-orchestration/tree/main/.claude/skills/domains/community/skills/agentic-actions-auditor
Command: npx skills add https://github.com/Canhada-Labs/ceo-orchestration --skill agentic-actions-auditor-canhada-labs

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides static security analysis for GitHub Actions workflows that invoke AI coding agents, detecting potential security risks and misconfigurations.

Core Features & Use Cases

Static Security Analysis: Traces attacker-controlled input through trigger events, env blocks, and configuration fields to detect nine injection and misconfiguration vectors.
Structured Findings: Produces severity-graded findings with actionable remediation guidance.
Use Case: For any repository using AI coding agents in their GitHub Actions workflows, this Skill can help ensure the security posture of these workflows.

Quick Start

Run the agentic-actions-auditor skill on your GitHub Actions workflows to detect potential security risks.

Frequently Asked Questions about agentic-actions-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run static security analysis on GitHub Actions workflows that use AI coding agents?▼

Static security analysis for GitHub Actions workflows traces attacker-controlled input through trigger events, env blocks, and configuration fields to detect injection vectors and produces severity-graded findings with remediation guidance.

What security risks should I check for when integrating AI coding agents into GitHub workflows?▼

You should check for nine potential injection and misconfiguration vectors, tracing how attacker-controlled input flows through trigger events and environment blocks to manipulate AI coding agent configurations.

How do I identify prompt injection vulnerabilities in my GitHub Actions workflows?▼

Identify prompt injection vulnerabilities by tracing attacker-controlled input through trigger events and env blocks, detecting misconfigurations in AI coding agent invocations to produce structured, severity-graded findings.

Does this security analysis require any external dependencies or setup?▼

No external dependencies are required to use this Skill, allowing you to directly run static security analysis on your GitHub Actions workflows to detect potential security risks and misconfigurations.

What is the best way to audit GitHub Actions workflows for AI coding agent misconfigurations?▼

The best way to audit AI coding agent misconfigurations is performing static security analysis that traces attacker-controlled input through trigger events and configuration fields, generating structured, severity-graded findings.

Why does my GitHub Actions workflow need static analysis when using AI coding agents?▼

Your workflow needs static analysis because AI coding agents can be exploited through attacker-controlled input in trigger events and env blocks, leading to severe security risks if left undetected and unremediated.