Security audit

CI/CD Pipeline

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward GitHub Actions CI/CD guidance skill; it includes powerful deployment and publishing examples, but they are disclosed and fit the stated purpose.

Before installing or using this skill, review any generated workflow that deploys, publishes, deletes secrets, grants write permissions, or opens tmate debugging. Prefer staging first, pin third-party actions and Docker images to immutable SHAs or digests, restrict GitHub token permissions, and protect production environments with required reviewers.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:116
Finding: Mutable Third-Party GitHub Actions and Docker Image References
Content: View full analysis
Remediation: View remediation
# stable at review time - uses: Swatinem/rust-cache@ # v2 - uses: softprops/action-gh-release@ # v2 ``` Apply the same approach to the Docker, tmate, and paths-filter Actions. 2. Pin Docker images by immutable digest instead of `latest`: ```bash docker run --rm \ -v "$(pwd):/repo" \ -w /repo \ rhysd/actionlint@sha256: ``` 3. Use controlled dependency-update automation, such as Dependabot or Renovate, to propose reviewed SHA and digest updates. Require code-owner approval for workflow changes. 4. Configure minimal workflow permissions globally and elevate them only in jobs that require additional access: ```yaml permissions: contents: read ``` Grant `packages: write`, `contents: write`, or other elevated capabilities only to narrowly scoped publishing jobs. 5. Avoid exposing secrets to third-party Actions unless necessary. Prefer GitHub OpenID Connect and short-lived credentials over long-lived deployment tokens where supported. 6. Protect release and production environments with required reviewers, branch restrictions, and deployment approval rules. 7. For interactive debugging Actions, retain actor restrictions, pin the Action to an immutable SHA, set a short job timeout, and ensure production secrets are unavailable to the debugging job. 8. Add policy enforcement, such as actionlint plus an organization policy or security scanner, that rejects unpinned `uses:` references and Docker images without digests. ]]>

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill includes ready-to-run examples for production deployment, container publishing, release creation, and npm publishing, but the skill description does not explicitly warn that these actions can modify live infrastructure or publish artifacts. In an agent context, this increases the risk that a user or downstream automation applies examples without realizing they are production-affecting.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

Low

Category: Tool Misuse
Confidence: 15% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 461)May include surrounding context.
actionlint .github/workflows/ci.yml

Or via Docker

docker run --rm -v "$(pwd):/repo" -w /repo rhysd/actionlint:latest

text
### View workflow as graph

Static analysis

No suspicious patterns detected.