domains / families / security / gha-security-review

gha-security-review

authentic

GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.

When to use

• review GitHub Actions
• audit workflows
• check CI security
• GHA security
• workflow security review
• review .github/workflows/
• pwn requests
• expression injection

When not to use

• Workflows in other repositories (only note the dependency)
• GitHub App installation permissions (note if relevant)

Skill page

Source