GitHub Actions Hardening
Install
Claude Code: add the marketplace once, then install.
/plugin marketplace add simplycubed/skills /plugin install github-actions-hardening@simplycubed Any agent (folder)
Download the folder at the source, then drop it into your agent's skills directory.
Folder: github-actions-hardening/
| Agent | Directory |
|---|---|
| Vendor-neutral (Codex, Gemini CLI, …) | .agents/skills/ |
| Claude Code | ~/.claude/skills/ |
| Gemini CLI | ~/.gemini/skills/ |
Summary
Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and…
Details
Passed automated static scanning. A point-in-time review, not a guarantee it is safe to run.
Scanned 2026-07-07: certify builtin · gitleaks 8.18.4 · osv-scanner 2.4.0 · semgrep n/a (no code)
✓ All checks clean
Flagged for review (non-blocking):
- injection.md: reference to secret/credential files
- report-format.md: exfiltration vocabulary
- supply-chain.md: exfiltration vocabulary
- triggers-and-privilege.md: posting secrets to a remote (defensive mention)
Credits
Written by GitHub awesome-copilot contributors
Keywords
#github-actions #security #hardening #ci