skills.rest
swarm-ai-research
swarm-ai-researchOFFICIAL
Explore all skills by this author →
Website𝕏@ResearchSwarmAIGitHub

workflow-security-audit

Audit GitHub workflows and composite actions for vulnerabilities and regressions.

Updated Jun 3, 2026
Search Tags:#automation#security#audit#pr#github-actions#workflow-security#delta-analysis
One-click install
npx skills add https://github.com/swarm-ai-research/aeon --skill workflow-security-audit-swarm-ai-research
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: workflow-security-audit
Source: https://github.com/swarm-ai-research/aeon/tree/main/skills/workflow-security-audit
Command: npx skills add https://github.com/swarm-ai-research/aeon --skill workflow-security-audit-swarm-ai-research

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audit GitHub workflows and composite actions to identify vulnerabilities and regressions.

Core Features & Use Cases

  • Enumerates and analyzes all .github/workflows and composite actions using zizmor and actionlint to surface security and reliability issues.
  • Classifies findings against prior audits (NEW, REINTRODUCED, UNCHANGED, RESOLVED) and generates delta-focused reports.
  • Auto-fixes for selected Critical/High issues and opens PRs only when deltas exist, minimizing noise in the workflow.
  • Supports end-to-end audit workflows, including result validation and artifact generation for governance.

Quick Start

Run the workflow-security-audit skill to scan all workflows and create the daily audit article.

Frequently Asked Questions about workflow-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit GitHub Actions workflows for security vulnerabilities?▼

This Skill audits GitHub Actions workflows and composite actions using zizmor and actionlint to surface security and reliability issues, classifying findings against prior audits to generate delta-focused reports.

What is delta analysis in CI pipeline security compliance?▼

Delta analysis in CI pipeline security compliance classifies audit findings against prior runs using fingerprint-based statuses like NEW, REINTRODUCED, UNCHANGED, and RESOLVED to highlight regressions and surface only relevant changes.

Can I automatically fix critical security issues in GitHub workflows and open a PR?▼

Yes, you can automatically fix Critical and High-severity security issues in GitHub workflows and open a PR when deltas exist, minimizing noise by only triggering pull requests for actual security changes.

Do I need zizmor and actionlint to scan composite actions for regressions?▼

Yes, zizmor and actionlint are required to enumerate and analyze composite actions and workflows to accurately surface security vulnerabilities and reliability regressions during the audit process.

What are the limitations of automating GitHub workflow security audits?▼

Limitations include relying on zizmor and actionlint for detection, applying auto-fixes only to Critical and High issues, and restricting automated PR creation strictly to when delta changes exist to minimize noise.

Related Skills

Explore More Software Engineering Skills→
y-miyazakiy-miyazaki
1

github-actions-validation

Validate GitHub Actions workflows with actionlint, ghalint, and zizmor.

Community
Advanced
anajuliabitanajuliabit
6

workflow-security-audit

Audit GitHub workflow definitions and composite actions for security regressions.

Community
Advanced
arbazkhan971arbazkhan971
26

devsecops

Integrate security scanning into CI/CD pipelines with blocking gates.

Community
Advanced
eliottbusinesseliottbusiness

requesting-code-review

Automate pre-commit code review with static analysis and security scanning.

Community
Advanced