gha-security-review

This skill performs a focused security review of GitHub Actions workflows with an exploitation-first approach. It is designed to identify real, externally exploitable vulnerabilities in CI/CD pipelines rather than theoretical or low-impact issues. The core goal is to analyze how an attacker without repository write access could manipulate workflow behavior to achieve outcomes such as code execution, credential theft, token exposure, or supply chain compromise. It evaluates workflow definitions and related repository configuration to reconstruct realistic attack paths before reporting any security findings.

The skill analyzes GitHub Actions workflows, reusable composite actions, and supporting configuration files to identify risky patterns and trace them into complete exploitation chains. It classifies triggers, evaluates expression injection risks, inspects third-party and local actions, and considers credential handling and runner environments. Findings are filtered by confidence level, reporting only medium and high-confidence issues. High-confidence findings require a fully validated attack path and include structured breakdowns of entry point, payload, execution mechanism, impact, and a proof-of-concept sketch. The threat model is strictly limited to external attackers, excluding issues requiring repository write access or internal triggers.

This skill is intended for security-focused review of CI/CD systems in real-world development environments. It is used by security engineers, DevSecOps teams, and maintainers who need to harden GitHub Actions pipelines against exploitation. It is also useful in penetration testing scenarios where the goal is to simulate external attacker capabilities against automation workflows. By focusing on practical exploitability, it helps teams prioritize and remediate vulnerabilities that could lead to real compromise of codebases, secrets, or deployment infrastructure.