agentic-actions-auditor

This Skill audits GitHub Actions workflows for AI agent security vulnerabilities by analyzing workflow YAML files and associated scripts. It identifies attack vectors and configuration issues that may lead to prompt injection, unauthorized access, and data exfiltration in your CI/CD pipelines.

AI agent vulnerabilities in CI/CD pipelines include prompt injection, unauthorized access, and data exfiltration. These security risks occur when attacker-controlled input reaches AI agents like Claude Code Action, Gemini CLI, OpenAI Codex, or GitHub AI Inference within GitHub Actions workflows.

Yes, you need Python and bash installed, along with the GitHub CLI (gh), to run security audits on GitHub Actions workflows. These dependencies are required to execute the scripts that analyze workflow YAML files and detect AI agent configuration issues.

Yes, you can use this auditor to check workflows running Gemini CLI and OpenAI Codex. It identifies potential vulnerabilities in GitHub Actions workflows that invoke AI agents, detecting security risks across multiple agent integrations including Claude Code Action and GitHub AI Inference.

The best way to detect prompt injection risks in GitHub Actions is to audit workflow YAML files and associated scripts for attack vectors where attacker-controlled input reaches AI agents. This Skill analyzes configuration issues that may lead to unauthorized access and data exfiltration.