Configure GitHub Actions workflows with least-privilege permissions and input sanitization.
npx skills add https://github.com/xiaolai/awful-for-claude --skill security-xiaolai
Please help me install this Agent Skill. Skill: security Source: https://github.com/xiaolai/awful-for-claude/tree/main/skills/awful/security Command: npx skills add https://github.com/xiaolai/awful-for-claude --skill security-xiaolai
Security model for awful workflows. GitHub Actions agents run with real credentials and can modify repos, post comments, and create PRs. Security is not optional.
Configure the default agent permissions to enforce least-privilege across workflows.
High-intent search queries and answers about installing and using this skill.
Fork PR protection in GitHub Actions prevents credential exposure by applying safe-outputs configurations and input sanitization, restricting what external contributors can execute or modify when triggering workflows.
You can restrict GitHub Actions agents by applying per-workflow permissions and enforcing a read-only default, ensuring agents only gain write access to explicitly required resources like comments or PRs.
GitHub Actions workflows need input sanitization for issue comments to prevent code execution risks and credential exposure, ensuring that triggers from issues and labels cannot inject malicious commands into the workflow.
A limitation of the least-privilege model for GitHub Actions is that overly restrictive per-workflow permissions may break automated PR creation or comment posting if the specific write permissions required are not explicitly granted.
adaptive-enforcement-labApply least-privilege GITHUB_TOKEN permissions across GitHub Actions workflows.
NetcrackerAudit GitHub Actions workflows and action.yml files for security issues and apply automated fixes.
askaretEnforce least privilege and safe practices in GitHub Actions workflows.
shellicarConfigure GitHub repository settings and enforce branch protection rules via the gh CLI.
