skills.rest
adaptive-enforcement-lab
adaptive-enforcement-labOFFICIAL
Explore all skills by this author →
GitHub

third-party-action-risk-assessment

Assesses GitHub Actions risks tier-wise and recommends SHA pinning or source audits for CI/CD adoption decisions.

3|3|Updated Jan 4, 2026
Search Tags:#risk-assessment#github-actions#security-review#workflow-governance#adoption-guidance#sha-pin#third-party-actions
One-click install
npx skills add https://github.com/adaptive-enforcement-lab/claude-skills --skill third-party-action-risk-assessment
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: third-party-action-risk-assessment
Source: https://github.com/adaptive-enforcement-lab/claude-skills/tree/main/plugins/secure/skills/third-party-action-risk-assessment
Command: npx skills add https://github.com/adaptive-enforcement-lab/claude-skills --skill third-party-action-risk-assessment

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Analyzes and governs the adoption of third-party GitHub Actions by applying a risk-tier framework, checklists, and governance guidance to prevent insecure or untrusted actions from being used in CI/CD pipelines.

Core Features & Use Cases

  • Tiered risk framework (Tier 1-4) for evaluating actions based on publisher trust, maintenance, and permissions.
  • Comprehensive risk assessment checklists and a decision tree to guide adoption decisions.
  • Practical guidance on SHA pinning, source review, fork strategies, and monitoring for ongoing security.

Quick Start

Assess a new action by running an initial risk review of its publisher and permissions to decide whether to pin, review, or fork.

Frequently Asked Questions about third-party-action-risk-assessment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I assess the security risk of third-party GitHub Actions before adding them to my CI/CD pipeline?▼

Assessing third-party GitHub Actions risk involves evaluating publisher trust, maintenance status, and requested permissions using a tiered risk framework to guide secure adoption decisions.

What is SHA pinning for GitHub Actions and why is it recommended for workflow governance?▼

SHA pinning for GitHub Actions locks dependencies to a specific commit hash, preventing supply chain attacks from upstream tag updates and ensuring predictable, auditable workflow governance.

Can I use a decision tree to determine whether to adopt, review, or fork a third-party Action?▼

Yes, a decision tree can evaluate third-party Actions based on risk tiers, guiding you through a structured checklist to adopt, review the source, or fork the repository.

What criteria define the risk tiers for evaluating third-party Actions in an organization?▼

Risk tiers for third-party Actions are defined by publisher trust, maintenance activity, and permissions scope, categorizing actions to apply appropriate security review and governance levels.

When should I fork a third-party GitHub Action instead of pinning its SHA?▼

Forking a third-party GitHub Action is preferred over SHA pinning when the action requires modification, the original publisher is untrusted, or ongoing internal maintenance is needed.

Does this risk assessment framework work for all CI/CD pipelines using GitHub Actions?▼

This risk assessment framework is designed for organizations using GitHub Actions in their CI/CD pipelines, applying tiered governance, source audits, and monitoring to secure action usage.

Related Skills

Explore More Software Engineering Skills→
jassicsjassics
6

pipeline-integrity-review

Reviews CI/CD pipelines for supply-chain tampering risks and prioritizes fixes.

Community
Advanced
v1truv1usv1truv1us
1

security-guidance

Automate vulnerability scanning and compliance checks across development workflows.

Community
Advanced
ArianHobson333ArianHobson333
7

source-code-scanning

Automate source code security scanning for vulnerabilities, CVEs, and hardcoded secrets.

Community
Advanced
hector-mannyhector-manny

production-audit

Audit local repository evidence to identify production risks for shipped apps.

Community
Advanced