agentic-actions-auditor
An agent skill by trailofbits, from trailofbits/skills. Tags: ai, automation, github-actions, prompt-injection, security.
What it does
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill agentic-actions-auditorOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/agentic-actions-auditor/skills/agentic-actions-auditor ~/.claude/skills/agentic-actions-auditorSafety box score
Grade B, low risk: 11 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This is a documentation-only auditor for GitHub Actions workflows that can read local workflow files and, in remote mode, fetch workflow YAML from GitHub via `gh api`. Its main exposure is limited shell/network access for read-only analysis; it does not modify files or execute fetched YAML.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 1 (low) | The skill explicitly allows `Bash` and says it is only for `gh api` calls, so it can execute shell commands but in a tightly bounded, read-only way. |
| Network access | 1 (low) | Remote analysis mode uses `gh api repos/{owner}/{repo}/contents/.github/workflows/...` to download workflow files from GitHub. |
| Filesystem reach | 1 (low) | It reads local workflow files and, via cross-file resolution, local `action.yml` / reusable workflow files, but the scope is limited to repository workflow paths. |
| Secrets & credentials | 0 (none) | The skill inspects workflow configs for secret-related patterns, but it does not read or request actual secret values from the machine. |
| Privilege & persistence | 0 (none) | There is no sudo, service installation, shell startup editing, or other privilege-changing behavior in the skill files. |
| Instruction hijack surface | 0 (none) | The files contain no instructions to skip confirmations, hide behavior, or follow untrusted external instructions; they are ordinary audit guidance. |
| Irreversible actions | 0 (none) | The skill analyzes and reports findings only; it does not push, deploy, send messages, or otherwise act on the user's behalf. |
| Transparency | 0 (none) | The shipped files are plain text Markdown, YAML, and SVG; there are no binaries, embedded installers, or decoded-at-runtime blobs. |
Before installing
- Confirm you are OK with the agent using `Bash` for read-only `gh api` calls.
- Decide whether remote GitHub content fetches are acceptable for your environment.
- Verify you only want analysis: this skill does not modify files or execute fetched YAML.
Rated 2026-10-20 by an automated review of 15 files from the skill's repository.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md
- Branch
- main
- Collection
- agentic-actions-auditor
- Updated
- 2026-09-19
Related skills
- secure-workflow-guide — Guides through Trail of Bits' 5-step secure development workflow.
- agents-build — Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments.
- agents-connect — Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.
- agents-pay — Use when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments.
- app-platform-sandbox — Create and manage isolated container sandboxes for AI agent code execution.
- loop-on-ci — Monitor PR checks and fix failures until green. Uses gh pr checks as the source of truth for PR-attached checks.