agentic-actions-auditor

To audit GitHub Actions workflows for AI agent security vulnerabilities, you need static workflow inspection, data flow tracing, and trigger analysis to identify insecure execution configurations and agentic attack vectors.

Prompt injection risk in CI/CD pipelines occurs when AI coding agents receive attacker-controlled input through environment variables, event payloads, or prompts, creating agentic attack paths that compromise workflow execution.

Detecting untrusted data flows in workflows using Claude Code Action or Gemini CLI requires tracing attacker-controlled inputs through environment variables, event payloads, and workflow configuration to find agentic attack paths.

You can review workflow permissions and sandbox settings for OpenAI Codex and GitHub AI Inference by evaluating tool permissions, user allowlists, triggers, and repository access patterns for risky security configurations.

Static workflow inspection for AI agent CI/CD security review is limited to analyzing configuration files, trigger conditions, and permission scopes without executing the pipeline to detect runtime prompt injection or dynamic data flow exploits.

Agentic-actions-auditor supports security configuration evaluation for GitHub Actions triggers by performing static workflow inspection to analyze risky repository access patterns and unsafe execution configurations.