Security audit

Github Actions Linter

Security checks for vulnerabilities and agentic risk

Overview

This is a local GitHub Actions linter with some accuracy gaps, but no hidden network access, persistence, or destructive behavior was found.

Reasonable to install for local GitHub Actions linting, but use it as an aid rather than a sole security gate. Prefer pointing it at specific workflow files or .github/workflows, and manually review multiline run blocks, third-party action pinning, and job-level permissions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/gha_linter.py:454
Finding: Multiline run blocks evade shell-injection and direct-secret checks
Content: View full analysis
Remediation: View remediation
`, multiline commands containing untrusted event fields, and multiline direct secret references. - Where practical, model the selected shell because quoting and metacharacter behavior differ between Bash, PowerShell, and other shells. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/gha_linter.py:523
Finding: Common list-form third-party actions bypass SHA-pinning validation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/gha_linter.py:491
Finding: Job-level broad permissions are omitted from the security audit
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
All commands use the bundled Python script at `scripts/gha_linter.py`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
All commands use the bundled Python script at `scripts/gha_linter.py`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
All commands use the bundled Python script at `scripts/gha_linter.py`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
All commands use the bundled Python script at `scripts/gha_linter.py`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
All commands use the bundled Python script at `scripts/gha_linter.py`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
md
All commands use the bundled Python script at `scripts/gha_linter.py`.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises capabilities that imply file reading and possible network access, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can let the skill be invoked with broader authority than intended, increasing the risk of unauthorized repository access, data exfiltration, or unsafe outbound requests if the backing implementation evolves or is misconfigured.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest uses broad trigger phrases such as 'check workflow', 'validate CI', and 'workflow issues', which can cause the skill to activate for general workflow-review requests outside its narrow GitHub Actions linting purpose. Over-broad routing increases the chance the agent applies this skill in the wrong context, potentially exposing files unnecessarily or producing misleading security conclusions during unrelated review tasks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This code reads the contents of user-specified workflow files from disk via Path(filepath).read_text(...), which is a file-access operation on a code file. While the operation is central to linting, there is no user-facing print/log at the point of access and no inline warning or disclosure in the function about reading local files.
Content: No source excerpt is available for this finding.