skills.rest
github
githubOFFICIAL
Explore all skills by this author →
WebsiteGitHub

developer-security

Provides security best practices for gh-aw workflows and Go code covering template injection, shell scripting, and supply chain hardening.

5.1k|530|Updated Aug 12, 2025
Search Tags:#static analysis#shell scripting#Security#supply chain#Permissions#template injection#GitHub actions
One-click install
npx skills add https://github.com/github/gh-aw --skill developer-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: developer-security
Source: https://github.com/github/gh-aw/tree/main/.github/skills/developer-security
Command: npx skills add https://github.com/github/gh-aw --skill developer-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Developers building GitHub Actions workflows and gh-aw agentic workflows risk introducing vulnerabilities like template injection, unquoted shell variables, unpinned action dependencies, and overly broad permissions. This Skill provides concrete secure and insecure patterns to prevent these issues during implementation and code review.

Core Features & Use Cases

  • Template Injection Prevention: Shows how to route untrusted input (issue titles, PR bodies, comments) through environment variables instead of direct ${{ }} expression interpolation, plus gh-aw sanitized context outputs.
  • Shell Script Hardening: Enforces quoting rules (SC2086), strict mode (set -euo pipefail), input validation, and shellcheck compliance for workflow scripts.
  • Supply Chain & Permissions Security: Requires SHA-pinned actions, minimal job-level permissions, and integration of static analysis tools (actionlint, zizmor, poutine) via gh aw compile.
  • Use Case: When writing a Go code generator that emits GitHub Actions if: conditions, use the cross-trigger nullability guidance to guard github.event.pull_request.* access behind github.event_name checks so workflows do not fail on push or schedule triggers.

Quick Start

Review my workflow file and Go condition-generation code against the security checklist to find template injection, shell quoting, and permission issues.

Frequently Asked Questions about developer-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent template injection in GitHub Actions workflows?▼

Pass untrusted input like issue titles or PR bodies through environment variables instead of interpolating them directly in run commands. The expression is evaluated in a controlled assignment context, so the shell receives the value as data rather than executable code.

How to securely use github.event data in workflow expressions?▼

Safe variables like github.actor, github.repository, and github.sha can be used directly, but event fields such as issue.title or comment.body must go through environment variables. In gh-aw, use the sanitized context output steps.sanitized.outputs.text for pre-filtered content.

Why should GitHub Actions be pinned to SHA instead of tags?▼

Tags can be deleted, recreated, or force-pushed, allowing supply chain attacks through modified action code. SHA commits are immutable, so pinning to a full commit hash with a version comment guarantees the exact code that runs.

Why does my workflow fail with startup_failure on push triggers?▼

Generated if conditions that access github.event.pull_request fields fail when the trigger is push, schedule, or workflow_dispatch because that object does not exist. Guard nested fields with github.event_name checks and null checks for each parent object in the chain.

What static analysis tools can scan GitHub Actions workflows?▼

actionlint lints workflow syntax and shell scripts, zizmor scans for security vulnerabilities, and poutine analyzes supply chain risks. For gh-aw workflows, run them via gh aw compile with the --actionlint, --zizmor, and --poutine flags, optionally with --strict.

Related Skills

Explore More Software Engineering Skills→
sam-fakhreddinesam-fakhreddine

wfc-agentic

Generate GitHub Agentic Workflows as Markdown files with YAML frontmatter.

Community
Advanced
prowler-cloudprowler-cloud
14.7k

gh-aw

Create and maintain GitHub Agentic Workflows with secure frontmatter, safe-outputs, and MCP server configuration.

Official
Advanced
skyasu2skyasu2
2

security-audit-workflow

Automate pre-deployment security audits for Next.js/Supabase CI pipelines.

Community
Advanced
zcacereszcaceres
7

security-openssf

Automate OpenSSF Scorecard GitHub Action installation and remediation.

Community
Advanced