Security audit

GitHub Action Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated purpose, but it can write unvalidated AI-generated GitHub Actions workflows and documents unpinned npx execution.

Review this before installing. Prefer a pinned package version or local locked installation, do not run unpinned npx examples in sensitive repositories, avoid putting secrets or confidential infrastructure details in prompts, and manually inspect any generated workflow for permissions, triggers, secret use, third-party actions, and deployment behavior before committing it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned npm Package Execution Through npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/cli.ts:17
Finding: Unvalidated AI Output Can Be Installed as Executable GitHub Actions Configuration
Content: View full analysis
{ const res = await openai.chat.completions.create({ model: "gpt-4o-mini", messages: [ { role: "system", content: "You are a DevOps expert. Generate a complete GitHub Actions workflow YAML file based on the description. Use best practices: proper triggers, caching, environment variables, and job dependencies. Return ONLY the YAML content, no explanation.", }, { role: "user", content: `Create a GitHub Actions workflow: ${description}`, }, ], temperature: 0.3, }); return res.choices[0].message.content || ""; } ``` The `--install` path then writes the response directly into GitHub's workflow directory: ```ts .action(async (description, opts) => { const spinner = ora("Generating workflow...").start(); try { const yaml = await generateWorkflow(description); spinner.stop(); if (opts.install) { const dir = ".github/workflows"; fs.mkdirSync(dir, { recursive: true }); const file = path.join(dir, "ai-generated.yml"); fs.writeFileSync(file, yaml); console.log(`Workflow written to ${file}`); } else if (opts.output) { fs.writeFileSync(opts.output, yaml); console.log(`Workflow written to ${opts.output}`); } else { console.log("\n" + yaml + "\n"); } ``` ### Technical Analysis GitHub Actions workflow files are executable CI/CD configuration. Their steps may run shell commands, invoke third-party actions, access repository conten ...[truncated 3057 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose claims a substantive capability: generating GitHub Actions workflows from natural language. The supplied code does not implement that capability or any observable functionality; it is effectively a no-op declaration/export stub. This is a material mismatch in primary purpose because the code chunk does not reflect the described behavior.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 91% confidence
Finding: The lockfile includes form-data 4.0.5, which is flagged for a CRLF injection issue in multipart field names. This is a real supply-chain risk if the application passes attacker-controlled field names or filenames into multipart request construction, because it can corrupt request structure or inject unintended headers/body parts. In this skill, the package is only a transitive dependency of the OpenAI SDK, so exploitability depends on whether the code actually builds multipart uploads from untrusted input; that makes the issue less directly dangerous than if the skill explicitly handled arbitrary file/form uploads.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to run npx ai-github-action without pinning a specific package version. That allows whatever version is currently published under that package name to be fetched and executed, which creates a supply-chain risk if the package is updated maliciously or unexpectedly. In a tool that generates CI workflows, this is more dangerous because users are being asked to run code that may also modify repository automation configuration.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This usage example combines unpinned npx execution with the --install option, which increases risk because it both downloads and executes the latest package version and then writes directly into .github/workflows/. If the package were compromised, it could generate or install malicious workflow definitions that later run in GitHub Actions with repository secrets or deployment permissions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The README again recommends executing the package through unpinned npx, which exposes users to unexpected or malicious package changes at runtime. Because this example generates deployment-related workflow content, compromise could affect release pipelines, cloud credentials, or artifact publication if users trust and apply the output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README advertises an --install mode that writes directly to .github/workflows/ but does not warn users that this changes security-sensitive repository automation files. Workflow files are high-impact because they can execute code in CI, access repository tokens, and influence deployments, so silent or lightly-described direct writes increase the chance users will apply unsafe generated configurations without review.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill references environment-based capability by requiring an OPENAI_API_KEY, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates ambiguity about what runtime capabilities the skill expects and can lead to overbroad access in environments that infer or grant capabilities implicitly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Using npx ai-github-action without pinning to a specific version causes execution of whatever package version is current at install time. This exposes users to supply-chain risk, including malicious updates, dependency compromise, or unexpected behavior changes when the package is fetched and run.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The example invokes npx ai-github-action without a pinned version, which means users may execute unreviewed code from the latest published package. In a developer tooling context, this is especially risky because the tool may generate CI/CD workflows that influence build, deployment, and secrets handling.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This unpinned npx usage can pull and execute arbitrary future package revisions, creating a straightforward supply-chain attack surface. Because the command also offers an --install flow, users may be more likely to trust and persist whatever code is fetched.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The Docker/ECR example uses an unversioned npx package, which could let a compromised package generate dangerous workflow steps affecting container publishing or cloud deployment. The CI/CD context increases impact because generated output may later run with repository or cloud credentials.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Running an unpinned package for scheduled backup workflow generation still exposes users to remote code execution from a future malicious or compromised release. Even though this example is less obviously privileged than deployment, generated scheduled jobs may handle sensitive data or infrastructure tasks.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The help command still causes npx to resolve and execute the package, so leaving it unpinned retains the same supply-chain risk as functional examples. Users may assume --help is harmless, making them less cautious about executing a latest-version package.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The function sends the user-provided workflow description to the OpenAI API, which is an external network service, without any indication in the code of notice, consent, redaction, or data-handling controls. In a CI/setup assistant context, users may include repository details, secrets, internal infrastructure names, or pipeline logic in the prompt, causing unintended third-party disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The function sends raw user-provided workflow descriptions to the OpenAI API, which is an external third-party service, and there is no visible notice, consent flow, or minimization logic in this code. If users include proprietary CI details, secrets, internal repository names, or deployment architecture in the prompt, that information may be disclosed outside the local trust boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The file reads process.env.OPENAI_API_KEY, which is access to a sensitive credential source. There is no inline comment, docstring, or user-facing notice describing this credential dependency or its security implications.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 10)May include surrounding context.
json
"scripts": { "build": "tsc" }, "keywords": ["github", "actions", "ci", "cd", "workflow", "ai"], "license": "MIT", "dependencies": { "commander": "^12.1.0", "openai": "^4.73.0", "ora": "^5.4.1" }, "devDependencies": { "typescript": "^5.6.0", "@types/node": "^22.0.0" }, "author": "LXGIC Studios", "repository": { "type": "git", "url": "https://github.com/lxgicstudios/ai-github-action" }

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 10)May include surrounding context.
json
"scripts": { "build": "tsc" }, "keywords": ["github", "actions", "ci", "cd", "workflow", "ai"], "license": "MIT", "dependencies": { "commander": "^12.1.0", "openai": "^4.73.0", "ora": "^5.4.1" }, "devDependencies": { "typescript": "^5.6.0", "@types/node": "^22.0.0" }, "author": "LXGIC Studios", "repository": { "type": "git", "url": "https://github.com/lxgicstudios/ai-github-action" }

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 10)May include surrounding context.
json
"scripts": { "build": "tsc" }, "keywords": ["github", "actions", "ci", "cd", "workflow", "ai"], "license": "MIT", "dependencies": { "commander": "^12.1.0", "openai": "^4.73.0", "ora": "^5.4.1" }, "devDependencies": { "typescript": "^5.6.0", "@types/node": "^22.0.0" }, "author": "LXGIC Studios", "repository": { "type": "git", "url": "https://github.com/lxgicstudios/ai-github-action" }

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 11)May include surrounding context.
json
"keywords": ["github", "actions", "ci", "cd", "workflow", "ai"], "license": "MIT", "dependencies": { "commander": "^12.1.0", "openai": "^4.73.0", "ora": "^5.4.1" }, "devDependencies": { "typescript": "^5.6.0", "@types/node": "^22.0.0" }, "author": "LXGIC Studios", "repository": { "type": "git", "url": "https://github.com/lxgicstudios/ai-github-action" } }

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 11)May include surrounding context.
json
"keywords": ["github", "actions", "ci", "cd", "workflow", "ai"], "license": "MIT", "dependencies": { "commander": "^12.1.0", "openai": "^4.73.0", "ora": "^5.4.1" }, "devDependencies": { "typescript": "^5.6.0", "@types/node": "^22.0.0" }, "author": "LXGIC Studios", "repository": { "type": "git", "url": "https://github.com/lxgicstudios/ai-github-action" } }

Static analysis

No suspicious patterns detected.