agentic-actions-auditor

Static security analysis for GitHub Actions workflows invoking AI coding agents. Static security analysis guidance for GitHub Actions workflows that invoke AI coding agents. This skill teaches you how to discover workflow files locally or from remote GitHub repositories, identify AI action steps, follow cross-file references to composite actions and reusable workflows that may contain hidden AI agents, capture security-relevant configuration, and detect attack vectors where attacker-controlled input reaches an AI agent running in a CI/CD pipeline. When auditing agentic actions, reject these common rationalizations. Each represents a reasoning shortcut that leads to missed findings. 1. "It only runs on PRs from maintainers" Wrong because it ignores pull_request_target , issue_comment , and other trigger events that expose actions to external input. Attackers do not need write access to trigger these workflows.