Individual skill
securing-github-actions-workflows
Hardens GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation: pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, protecting secrets, preventing script injection in workflow expressions, and requiring reviewers for workflow changes. Use when hardening GitHub Actions workflows that handle secrets, deploy to production, or run with elevated permissions.
skills/securing-github-actions-workflows/SKILL.md
Source commit 54a798831d2266a3ca61ce68a7acb80b81160d57
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Local scripts
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 35,909
- Repository last updated
- Aug 31, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai-agents Repository topic
- claude-code Repository topic
- cybersecurity Repository topic
- incident-response Repository topic
- mitre-attack Repository topic
- penetration-testing Repository topic
- red-team Repository topic
- security Repository topic
- cloud-security Repository topic
- malware-analysis Repository topic
- devsecops Declared skill tag
- cicd Declared skill tag
- github-actions Declared skill tag
- supply-chain Declared skill tag
- workflow-security Declared skill tag
- secure-sdlc Declared skill tag
- operations Derived category
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
LICENSEasset · 11,255 bytesSKILL.mdcore · 8,754 bytesassets/template.mddoc · 1,016 bytesreferences/api-reference.mddoc · 1,844 bytesreferences/standards.mddoc · 1,152 bytesreferences/workflows.mddoc · 1,192 bytesscripts/agent.pyruns · 8,248 bytesscripts/process.pyruns · 7,533 bytes
Read excerpt
# Securing GitHub Actions Workflows
## When to Use
- When GitHub Actions is the CI/CD platform and workflows need hardening against supply chain attacks
- When workflows handle secrets, deploy to production, or have elevated permissions
- When preventing script injection via untrusted PR titles, branch names, or commit messages
- When requiring audit trails and approval gates for workflow modifications
- When third-party actions pose supply chain risk through mutable version tags
**Do not use** for securing other CI/CD platforms (see platform-specific hardening guides), for application vulnerability scanning (use SAST/DAST), or for secret detection in code (use Gitleaks).
## Prerequisites
