agentic-actions-auditor

Auditing GitHub Actions workflows for prompt injection involves identifying AI action steps and tracing attacker-controlled inputs from events or env vars to prompt content, producing findings with remediation guidance.

AI agent integrations using Claude Code Action, Gemini CLI, OpenAI Codex, or GitHub AI Inference are vulnerable to data exfiltration when untrusted inputs reach prompts via push, pull_request_target, or workflow_call triggers.

Cross-file resolution detects security risks in nested GitHub workflows by analyzing cross-file references and capturing security-relevant inputs from with: blocks and env: blocks across the triggered workflow chain.

Yes, you can trace workflow inputs to AI system prompts in pull_request_target events by capturing security-relevant inputs from with: blocks and env: blocks, mapping how prompts and system prompts are formed.

Auditing limitations include handling deeply nested cross-file references in complex workflow_call chains, where tracing attacker-controlled inputs to prompt content requires complete visibility into env: and with: blocks.