What problem does it solve? GitHub Actions workflows often contain exploitable vulnerabilities like pwn requests, expression injection, and credential exposure that generic CI/CD security advice misses. This Skill audits workflow files against real-world attack patterns and reports only findings with a traceable exploitation path. ## Core Features & Use Cases - Exploitation-Focused Auditing: Checks eight vulnerability classes including pwn requests, expression injection, comment-triggered command execution, credential escalation, config file poisoning, supply chain risks, permissions, and runner infrastructure. - Confidence-Gated Reporting: Reports only HIGH and MEDIUM confidence findings, requiring a five-element attack path (entry point, payload, execution mechanism, impact, PoC sketch) before flagging an issue. - Real-World Attack References: Loads detailed reference material based on the HackerBot Claw campaign that compromised repositories like trivy and awesome-go. - Use Case: Ask for a security review of your repository's .github/workflows/ directory before open-sourcing a project, and receive a structured report of confirmed vulnerabilities with fixes and safe patterns explicitly cleared. ## Quick Start Review the GitHub Actions workflows in this repository for exploitable security vulnerabilities and report findings with exploitation scenarios.
