GitHub Actions OIDC Hardening Audit

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:16 AM UTC
• Version: 1.0.0

Overview

This skill is a local GitHub Actions workflow audit tool with disclosed read-only scanning behavior, though its regex-based checks should be treated as advisory rather than complete proof of hardening.

Install only if you want a lightweight local audit for GitHub Actions cloud-auth workflows. Treat results as a helpful signal, not a complete security review, especially for complex multi-job workflows where YAML structure and effective permissions matter.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/oidc-hardening-audit.sh:102

Finding

Workflow-Wide Regex Checks Can Miss Insecure Job-Level OIDC Configurations

Content

View full analysis

Vulnerability Details

File Location: scripts/oidc-hardening-audit.sh, lines 102–103, 139–140, and 165–176
Vulnerability Type: Incorrect security validation caused by unscoped text matching
Risk Level: Medium

Vulnerable code:

python

perm_id_token_write_re = re.compile(r"^\s*id-token\s*:\s*write\s*(?:#.*)?$", re.IGNORECASE | re.MULTILINE)
role_to_assume_re = re.compile(r"^\s*role-to-assume\s*:\s*[^\s#]+")

python

lines = text.splitlines()
has_id_token_write = bool(perm_id_token_write_re.search(text))
auth_actions = []
floating_refs = []
aws_action_lines = set()
aws_role_to_assume_present = False
aws_static_input_present = False
secret_cloud_key_lines = []

python

if not has_id_token_write:
    score += 4
    issues.append({
        'code': 'missing_id_token_write',
        'message': 'Workflow uses cloud auth action(s) but does not declare id-token: write permissions.',
        'weight': 4,
    })

if any(action['provider'] == 'aws' for action in auth_actions):
    if not aws_role_to_assume_present:
        score += 2
        issues.append({
            'code': 'aws_role_to_assume_missing',
            'message': 'AWS auth action is present but role-to-assume is missing (OIDC federation likely incomplete).',
            'weight': 2,
        })

Technical Analysis

The scanner analyzes each workflow as unstructured text rather than parsing its YAML hierarchy. The has_id_token_write and aws_role_to_assume_present variables therefore represent whether matching text appears anywhere in the file, not whether the setting applies to the job or authentication step being audited.

GitHub Actions supports workflow-level and job-level permissions. A job-level permissions block can override workflow-level permissions. Consequently, an id-token: write declaration in one job, or at workflow level when overridden by the cloud-authentication jo ...[truncated 1851 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace regex-based workflow interpretation with structural YAML parsing through a safe loader.
2. Analyze every jobs.<job_id> object independently and associate each cloud authentication action with its containing job and exact step.
3. Resolve effective permissions according to GitHub Actions semantics:
   • Read workflow-level permissions.
   • Apply job-level permission overrides.
   • Verify that the specific cloud-authentication job has effective id-token: write.
4. Inspect role-to-assume, static credential inputs, and provider-specific options only within the with mapping of the corresponding authentication step.
5. Do not count matching strings found in comments, shell commands, environment values, or YAML block scalars as configuration.
6. Add regression tests covering multiple jobs, job-level permission overrides, unrelated role-to-assume fields, YAML block scalars, and multiple AWS authentication steps with different configurations.
7. Fail safely or emit an explicit parse error when a workflow cannot be structurally parsed, rather than deriving security conclusions from partial text matches.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow uses long-lived AWS access keys from GitHub Secrets instead of GitHub Actions OIDC-based short-lived credentials. In the context of a skill specifically meant to audit GitHub Actions OIDC hardening gaps, this is a real security weakness because static cloud credentials increase the blast radius of repository compromise, secret exfiltration, or workflow abuse, and there is no indication of safer federation-based authentication or disclosure controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The workflow authenticates to GCP using a long-lived static service account key stored in GitHub Secrets via credentials_json. In the context of an OIDC-hardening audit skill, this is a real security weakness because static cloud credentials are more theft-prone, harder to rotate, and bypass the stronger short-lived federation model expected for GitHub Actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

After authenticating with GCP credentials, the workflow executes a gcloud command, indicating interaction with cloud account context. The file provides no inline warning or descriptive comment that the workflow will authenticate to and query GCP, which is a safety-relevant operation involving external systems.

Content

No source excerpt is available for this finding.