What problem does it solve? CI/CD pipelines run with privileged credentials and are a common attack surface, yet workflow misconfigurations like overprivileged tokens, untrusted input interpolation, and unpinned actions often go unnoticed until exploited. This Skill performs a structured, read-only security review of GitHub Actions and similar CI workflows before they cause damage. ## Core Features & Use Cases - Untrusted Execution Analysis: Detects pull_request_target abuse, fork-controlled code execution with privileged tokens, and unsafe interpolation of branch names, PR text, or dispatch inputs into shell scripts. - Permissions, Secrets, and Provenance Checks: Audits job-level permissions, secret scoping, OIDC usage, third-party action pinning to commit SHAs, and cache/artifact trust boundaries. - Repository Publication Review: Distinguishes first-public from version-release reviews, checking full reachable Git history, tags, and release assets for committed secrets before visibility changes. - Use Case: Before merging a new deploy workflow, run this Skill to flag floating action tags, cross-trust cache restoration, and credential-bearing artifacts, then receive a severity-ranked report with minimal safe remediations. ## Quick Start Ask the assistant to perform a read-only security review of the GitHub Actions workflows in this repository and report findings by severity.
