gha-security-review

Audit GitHub Actions workflows for exploitable security vulnerabilities.

1|Updated Feb 22, 2026

Search Tags:#github actions #ci/cd security #vulnerability scanning #workflow security #expression injection #pwn request

Ready to run

npx skills add https://github.com/sergical/pi-config --skill gha-security-review

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: gha-security-review
Source: https://github.com/sergical/pi-config/tree/main/skills/gha-security-review
Command: npx skills add https://github.com/sergical/pi-config --skill gha-security-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill identifies and helps you fix exploitable security vulnerabilities within your GitHub Actions workflows, protecting your CI/CD pipelines from compromise.

Core Features & Use Cases

Vulnerability Detection: Scans workflows for common attack patterns like pwn requests, expression injection, and credential escalation.
Exploitation Scenarios: Provides concrete Proof-of-Concept (PoC) scenarios for each finding.
Mitigation Guidance: Offers specific fixes and best practices to secure your workflows.
Use Case: You need to ensure your CI/CD pipelines are secure before merging a critical update. This Skill will audit your .github/workflows/ directory for any security risks that an external attacker could exploit.

Quick Start

Use the gha-security-review skill to audit all GitHub Actions workflows in the repository for security vulnerabilities.

Frequently Asked Questions about gha-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit GitHub Actions workflows for security vulnerabilities?▼

To audit GitHub Actions workflows for security vulnerabilities, scan the `.github/workflows/*.yml` files to identify exploitable attack patterns like pwn requests, expression injection, and credential theft. This process provides concrete exploitation scenarios and mitigation advice to secure your CI/CD pipelines.

What is a pwn request in GitHub Actions CI/CD security?▼

A pwn request in GitHub Actions CI/CD security is an attack pattern where an external attacker exploits a workflow trigger to compromise the pipeline. Auditing workflows identifies these vulnerabilities alongside expression injection and credential theft, providing specific PoC scenarios and fixes to prevent unauthorized access.

How do I prevent expression injection in GitHub Actions workflows?▼

To prevent expression injection in GitHub Actions workflows, audit your `.github/workflows/*.yml` configuration files to locate untrusted input handling vulnerabilities. The audit provides specific mitigation guidance and best practices to secure workflow expressions against malicious code execution.

Can I scan my CI/CD pipelines for supply chain attacks before merging critical updates?▼

Yes, you can scan your CI/CD pipelines for supply chain attacks before merging critical updates by auditing the `.github/workflows/` directory. This identifies security risks like credential escalation and provides concrete fixes to ensure your pipelines are secure against external attackers.

What are the limitations of auditing GitHub Actions workflow files?▼

The limitations of auditing GitHub Actions workflow files include a strict focus on `.github/workflows/*.yml` and related configuration files. The audit targets specific attack vectors like expression injection, pwn requests, and credential theft, rather than providing a comprehensive application code security scan.