gha-security-review — Skills

What it does

.github/workflows/.yml — all workflow definitions

action.yml / action.yaml — composite actions in the repo

.github/actions//action.yml — local reusable actions

Config files loaded by workflows: CLAUDE.md, AGENTS.md, Makefile, shell scripts under .github/

Workflows in other repositories (only note the dependency)

GitHub App installation permissions (note if relevant)

workflowdispatch input injection — requires write access to trigger

Requirements & configuration

Do not flag vulnerabilities that require write access to exploit:

workflowdispatch input injection — requires write access to trigger

| MEDIUM | Attack path partially confirmed, uncertain link | Report as needs verification |

4. Impact — What does the attacker gain? (token theft, code execution, repo write access)

If you cannot construct all five, report as MEDIUM (needs verification).

Configuration: CLAUDEAGENTS

gha security review

Source

Repository: https://github.com/getsentry/skills

gha-security-review FAQ

What does the gha-security-review skill do?

GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios. .github/workflows/.yml — all workflow definitions action.yml / action.yaml — composite actions in the repo

What does gha-security-review require?

Do not flag vulnerabilities that require write access to exploit: workflowdispatch input injection — requires write access to trigger | MEDIUM | Attack path partially confirmed, uncertain link | Report as needs verification | 4. Impact — What does the attacker gain? (token theft, code execution, repo write access) If you cannot construct all five, report as MEDIUM (needs verification). Configuration keys: CLAUDE, AGENTS.

How do I install gha-security-review?

Run: npx -y skills add https://github.com/getsentry/skills --skill gha-security-review --agent claude-code — the source lives at github.com/getsentry/skills.

Maintain gha-security-review?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[gha-security-review on getagentictools](https://getagentictools.com/skills/getsentry-skills-gha-security-review?ref=badge)

npx agentictools info skills/getsentry-skills-gha-security-review

The second line is the CLI lookup for this page — handy in READMEs and docs.