agentic-actions-auditor

Audit GitHub Actions workflows for AI agent security vulnerabilities.

Updated Jun 9, 2026

Search Tags:#github actions #prompt injection #security auditing #ai agent security #ci/cd pipeline security

Ready to run

npx skills add https://github.com/iiammae/opero --skill agentic-actions-auditor-iiammae

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: agentic-actions-auditor
Source: https://github.com/iiammae/opero/tree/main/.agents/skills/agentic-actions-auditor
Command: npx skills add https://github.com/iiammae/opero --skill agentic-actions-auditor-iiammae

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires gh, jq, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill automatically scans and analyzes GitHub Actions workflows to detect potential security vulnerabilities, helping to identify risks related to AI agent integrations and CI/CD pipeline security.

Core Features & Use Cases

Security Vulnerability Detection: Scans workflows for known vulnerabilities, including attack vectors that expose AI agents to attacker-controlled input.
AI Agent Security Assessment: Identifies AI agent integrations and evaluates their security configurations.
CI/CD Pipeline Security Auditing: Audits workflows for common security risks in CI/CD pipelines, including prompt injection and data exfiltration.

Quick Start

To start auditing a GitHub Actions workflow, provide the repository URL or owner/repo identifier.

Frequently Asked Questions about agentic-actions-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit GitHub Actions workflows for AI agent security vulnerabilities?▼

To audit GitHub Actions workflows for AI agent security, provide a repository URL or owner/repo identifier. The Skill scans workflow files locally or remotely to detect attack vectors where attacker-controlled input reaches AI agents in CI/CD pipelines.

What is prompt injection in CI/CD pipelines and how does it affect AI agents?▼

Prompt injection in CI/CD pipelines occurs when attacker-controlled input reaches AI agents running in workflows, potentially causing data exfiltration or unauthorized actions. This Skill identifies these attack vectors by analyzing GitHub Actions workflow configurations.

Do I need GitHub API access to scan remote repositories for workflow security issues?▼

Yes, GitHub API access is required to scan remote repositories for workflow security issues. You can also analyze workflow files locally. The Skill uses gh and jq dependencies to parse and audit GitHub Actions configurations.

Can I use this Skill to check both local and remote GitHub Actions workflows?▼

Yes, you can audit both local and remote GitHub Actions workflows. Provide a local workflow file path or a remote repository URL and owner/repo identifier to scan for AI agent security vulnerabilities and CI/CD pipeline risks.

What types of security risks does this auditor detect in GitHub Actions?▼

This auditor detects security risks in GitHub Actions including prompt injection attack vectors, data exfiltration vulnerabilities, and misconfigured AI agent integrations where attacker-controlled input could compromise CI/CD pipeline security.