gha-security-review

Name: gha-security-review
Availability: InStock
Author: Sentry

Analyze GitHub Actions workflows for security vulnerabilities and misconfigurations.

905|47|Updated Jan 5, 2026

Search Tags:#security #vulnerability #github #permissions #threat-modeling #workflows #actions

Ready to run

npx skills add https://github.com/getsentry/skills --skill gha-security-review-getsentry

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: gha-security-review
Source: https://github.com/getsentry/skills/tree/main/skills/gha-security-review
Command: npx skills add https://github.com/getsentry/skills --skill gha-security-review-getsentry

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Identifies security vulnerabilities and misconfigurations in GitHub Actions workflows to prevent credential leakage, RCE, and secret exposure.

Core Features & Use Cases

Threat modeling across .github/workflows
Checks for pull_request_target vulnerabilities, unpinned actions, and permissive secrets
Remediation recommendations and safe defaults for CI workflows

Quick Start

Analyze GitHub Actions workflows and deliver an actionable security review with concrete hardening steps.

Frequently Asked Questions about gha-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check GitHub Actions workflows for security vulnerabilities?▼

To check GitHub Actions workflows for security vulnerabilities, analyze YAML files under .github/workflows to validate triggers, permissions, and secret exposure, identifying exploitable paths and mitigation gaps.

What is the pull_request_target vulnerability in GitHub Actions?▼

The pull_request_target vulnerability in GitHub Actions occurs when workflows execute code from untrusted forks with elevated secrets access, allowing attackers to leak credentials or achieve remote code execution through malicious pull requests.

How do I prevent secret exposure in GitHub Actions CI workflows?▼

To prevent secret exposure in GitHub Actions CI workflows, review workflow permissions, restrict trigger configurations, apply safe-guarded defaults, and ensure secrets are not accessible to untrusted pull request execution contexts.

Can I remediate unpinned actions in GitHub Actions workflows?▼

Yes, you can remediate unpinned actions in GitHub Actions workflows by applying concrete remediation guidance that maps reference vulnerabilities to safe-guarded defaults, ensuring actions are securely pinned and validated against threat models.

Does this security review process all workflow definitions in a repository?▼

Yes, this security review process applies to all workflow definitions under .github/workflows and related action definitions, validating triggers, permissions, and secret exposure to determine exploitable paths across the repository.

Why do I need threat modeling for GitHub Actions YAML configurations?▼

Threat modeling for GitHub Actions YAML configurations is required to systematically validate trigger conditions, permissions, and secret handling, producing concrete remediation guidance that closes exploitable paths and prevents credential leakage.