What problem does it solve? AI coding agents like Claude Code Action, Gemini CLI, and OpenAI Codex running in CI/CD pipelines can be exploited when attacker-controlled input (issue bodies, PR titles, comments) reaches their prompts. This Skill statically audits GitHub Actions workflows to detect these injection paths before they are exploited. ## Core Features & Use Cases - Nine Attack Vector Detections: Identifies env var intermediary injection, direct expression injection, CLI data fetches, pull_request_target checkout risks, error log injection, subshell expansion bypasses, eval of AI output, dangerous sandbox configs, and wildcard user allowlists. - Cross-File Resolution: Follows uses: references into composite actions and reusable workflows to find hidden AI agents, with input mapping traces across file boundaries. - Local and Remote Analysis: Audits workflow files on disk or fetches them from any GitHub repository via the gh CLI, producing severity-rated findings with data flow traces and remediation guidance. - Use Case: Point the Skill at a repository using anthropics/claude-code-action with pull_request_target triggers to discover whether an external contributor could inject prompts and exfiltrate secrets. ## Quick Start Audit the GitHub Actions workflows in this repository for AI agent prompt injection vulnerabilities and report any findings with severity ratings.
