magpie-workflow-security-audit

To perform a security audit on GitHub Actions workflows, use this Skill to conduct a read-only scan that identifies injection vulnerabilities, permission issues, and unpinned external actions. It provides remediation suggestions without modifying your workflow files.

Common security vulnerabilities in GitHub workflows include injection vulnerabilities, excessive permissions, unpinned external actions, and self-hosted runner fork-secret leaks. This Skill detects these code-level risks and categorizes them during its audit process.

No, this security audit cannot automatically fix vulnerabilities in your GitHub workflows. It operates in read-only mode to identify and categorize risks, offering remediation suggestions that you must manually implement in your workflow files.

Yes, the audit detects self-hosted runner fork-secret leaks in GitHub Actions. It performs a comprehensive read-only scan to identify this specific risk alongside injection vulnerabilities, permission issues, and the usage of unpinned external actions.

The best way to check for unpinned external actions is to run a comprehensive security audit using this Skill. It identifies workflows using unpinned actions and provides specific remediation suggestions to secure your GitHub Actions configurations.