agentic-actions-auditor

Static security analysis for GitHub Actions workflows traces attacker-controlled input through trigger events, env blocks, and configuration fields to detect injection vectors and produces severity-graded findings with remediation guidance.

You should check for nine potential injection and misconfiguration vectors, tracing how attacker-controlled input flows through trigger events and environment blocks to manipulate AI coding agent configurations.

Identify prompt injection vulnerabilities by tracing attacker-controlled input through trigger events and env blocks, detecting misconfigurations in AI coding agent invocations to produce structured, severity-graded findings.

No external dependencies are required to use this Skill, allowing you to directly run static security analysis on your GitHub Actions workflows to detect potential security risks and misconfigurations.

The best way to audit AI coding agent misconfigurations is performing static security analysis that traces attacker-controlled input through trigger events and configuration fields, generating structured, severity-graded findings.

Your workflow needs static analysis because AI coding agents can be exploited through attacker-controlled input in trigger events and env blocks, leading to severe security risks if left undetected and unremediated.