skills.rest
anajuliabit
anajuliabitCOMMUNITY
Explore all skills by this author →
𝕏@anajuliabitGitHub

workflow-security-audit

Audit GitHub workflow definitions and composite actions for security regressions.

6|2|Updated May 21, 2026
Search Tags:#github actions#security audit#actionlint#zizmor#pull request automation#workflow hardening#vulnerability regression
One-click install
npx skills add https://github.com/anajuliabit/aeon --skill workflow-security-audit-anajuliabit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: workflow-security-audit
Source: https://github.com/anajuliabit/aeon/tree/main/skills/workflow-security-audit
Command: npx skills add https://github.com/anajuliabit/aeon --skill workflow-security-audit-anajuliabit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill audits GitHub Actions workflows and composite actions to find security issues and, importantly, highlights only what changed since the last audit to prevent alert fatigue.

Core Features & Use Cases

  • Workflow scanning with zizmor + actionlint: Runs static analysis over .github/workflows/*.yml|*.yaml and .github/actions/*/action.yml|*.yaml and maps findings into a consistent Critical/High/Medium/Low severity model.
  • Delta classification against the prior audit: Labels findings as NEW, REINTRODUCED, UNCHANGED, or RESOLVED using stable fingerprints so operators see regressions instead of repeating noise.
  • Automated remediation for NEW Critical/High injection issues: Applies idempotent fixes for specific shell/toJson injection patterns and writes a full report, while gating PR creation to cases where the delta is non-empty.

Quick Start

Use the workflow-security-audit skill to audit every workflow and action under .github/ for security issues, auto-fix NEW Critical/High injection cases, and open a PR only when the audit discovers meaningful changes.

Frequently Asked Questions about workflow-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect security regressions in GitHub Actions workflows?▼

Detect GitHub Actions workflow security regressions by running static scanners like zizmor and actionlint over workflow definitions, then comparing findings against a prior audit baseline using stable fingerprints to isolate only NEW or REINTRODUCED vulnerabilities.

How does fingerprint-based delta reporting prevent alert fatigue in workflow auditing?▼

Fingerprint-based delta reporting prevents alert fatigue in workflow auditing by classifying scanner findings as NEW, REINTRODUCED, UNCHANGED, or RESOLVED, ensuring operators only review meaningful security regressions instead of repeated unchanged noise.

Can I automatically fix shell injection vulnerabilities in GitHub Actions pull requests?▼

You can automatically fix shell injection vulnerabilities in GitHub Actions by applying idempotent auto-remediation to eligible NEW Critical and High injection patterns, gating pull request creation to only open when non-empty security deltas are discovered.

Does zizmor work with actionlint for auditing composite actions?▼

Zizmor works alongside actionlint to audit composite actions by running static analysis over `.github/actions/*/action.yml` files, mapping detected security findings into a consistent severity model for continuous workflow hardening.

What is the best way to automate scheduled security hygiene for GitHub workflows?▼

The best way to automate scheduled security hygiene for GitHub workflows is to run recurring static analysis audits that generate SARIF/JSON-derived findings, auto-fix eligible injection issues, and open pull requests only when meaningful security regressions are detected.

Related Skills

Explore More Legal & Compliance Skills→
pagopapagopa
1

TechAICompositeAction

Create and modify GitHub composite actions with secure Bash scripting.

Official
Intermediate
weside-aiweside-ai

audit

Automate security audits in code repositories and summarize JSON findings.

Official
Advanced
swarm-ai-researchswarm-ai-research

workflow-security-audit

Audit GitHub workflows and composite actions for vulnerabilities and regressions.

Official
Advanced
roderikroderik
2

codeql

Identify security vulnerabilities in source code using CodeQL static analysis.

Community
Advanced