Skip to content
Get packs

GitHub Actions Hardening

Reviews GitHub Actions workflows for injection, token scope, and supply-chain security risks

Source Download skill
Repository
github/awesome-copilot
Stars
40,703
Licence
MIT
Files
6 files

What it does

Once installed, the agent reviews GitHub Actions workflow files (the automation YAML in .github/workflows) for security problems that general code linters often miss, such as untrusted text being pasted into shell commands, risky triggers that run outside code with secret access, unpinned third-party actions, and overly broad token permissions. It produces a severity-ranked report with concrete before-and-after fixes and presents them for human review rather than applying them automatically.

Great for

  • Developers and maintainers who want to audit or harden their CI workflows
  • Teams writing new workflows who want secure defaults
  • Open-source maintainers accepting pull requests from outside contributors

Skip it if

  • Non-GitHub CI systems such as Jenkins or GitLab, since the guidance is specific to GitHub Actions
  • Anyone expecting a guarantee of security; it is a reviewer that reasons from guidance and can miss issues or flag false positives

Try asking

  • “Is this workflow safe? Review .github/workflows/ci.yml for security issues”
  • “Why is pull_request_target dangerous in my build workflow?”
  • “Pin all my third-party actions to commit SHAs and explain the changes”
  • “Lock down GITHUB_TOKEN permissions for my release workflow”
Step-by-step guide: how to use GitHub Actions HardeningInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 6 original files, the MIT licence and an attribution note.

    github-actions-hardening.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip github-actions-hardening.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip github-actions-hardening.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Point the agent at specific workflow files so it can map triggers, permissions, and uses: lines in order
  • Review the proposed fixes yourself before applying them, since the skill intentionally never auto-applies changes
  • Pair it with a dedicated scanner or code review for application-level vulnerabilities, which this skill does not target

What's inside

  • references/injection.md
  • references/permissions-and-tokens.md
  • references/report-format.md
  • references/supply-chain.md
  • references/triggers-and-privilege.md
  • SKILL.md

Redistributed unmodified from github/awesome-copilot under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.