gha-security-review

What problem does it solve?

This Skill identifies and helps you fix exploitable security vulnerabilities within your GitHub Actions workflows, protecting your CI/CD pipelines from compromise.

Core Features & Use Cases

• Vulnerability Detection: Scans workflows for common attack patterns like pwn requests, expression injection, and credential escalation.
• Exploitation Scenarios: Provides concrete Proof-of-Concept (PoC) scenarios for each finding.
• Mitigation Guidance: Offers specific fixes and best practices to secure your workflows.
• Use Case: You need to ensure your CI/CD pipelines are secure before merging a critical update. This Skill will audit your .github/workflows/ directory for any security risks that an external attacker could exploit.

Quick Start

Use the gha-security-review skill to audit all GitHub Actions workflows in the repository for security vulnerabilities.