gha-security-review

Analyze GitHub Actions workflows for security vulnerabilities.

Updated May 4, 2026

Search Tags:#vulnerability assessment #GitHub Actions #security review #workflow security #GitHub security

Ready to run

npx skills add https://github.com/luokai25/luo-ai-skills-market --skill gha-security-review-luokai25

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: gha-security-review
Source: https://github.com/luokai25/luo-ai-skills-market/tree/main/06-security-and-auth%20%28by%20Luo%20Kai%29/05-devsecops/gha-security-review
Command: npx skills add https://github.com/luokai25/luo-ai-skills-market --skill gha-security-review-luokai25

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and mitigate potential security vulnerabilities in GitHub Actions workflows, ensuring they are secure against common attack vectors.

Core Features & Use Cases

Security Review: Analyzes workflows for vulnerabilities like pwn requests, expression injection, credential escalation, and config file poisoning.
Vulnerability Identification: Identifies and categorizes potential security issues based on their severity and exploitability.
Best Practices Guidance: Provides recommendations for securing workflows and actions, including permission scopes and secret management.
Use Case: For a developer looking to audit and harden their GitHub Actions workflows against common security risks.

Quick Start

Run the gha-security-review skill on your GitHub Actions workflow to begin the security review process.

Frequently Asked Questions about gha-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check my GitHub Actions workflows for security vulnerabilities?▼

To check your GitHub Actions workflows for security vulnerabilities, perform a security review to analyze workflow configurations and code for common attack vectors like pwn requests and expression injection, categorizing potential security issues by severity and exploitability.

What is a pwn request and how does it affect workflow security?▼

A pwn request is a common attack vector in GitHub Actions workflow security where an external user triggers a workflow with malicious payloads, potentially escalating credentials or poisoning config files. Identifying this risk requires analyzing workflow configuration triggers and code execution paths.

Do I need GitHub API access to perform a workflow security review?▼

Yes, you need GitHub API access to perform a workflow security review. Accessing the API is a prerequisite for analyzing workflow configurations and code, identifying vulnerabilities like expression injection, and evaluating permission scopes and secret management practices.

How do I prevent expression injection in GitHub Actions config files?▼

To prevent expression injection in GitHub Actions config files, perform a targeted security review to identify and mitigate untrusted input being evaluated in workflow expressions, applying best practice recommendations for securing permissions and managing secrets safely.

What are the limitations of auditing GitHub Actions for credential escalation?▼

Auditing GitHub Actions for credential escalation requires knowledge of GitHub Actions configuration and focuses on common attack vectors. Limitations include the need for GitHub API access and the necessity of understanding permission scopes and secret management to accurately identify and categorize exploitability.