Skills github-actions-templates

📦

github-actions-templates

Name: github-actions-templates
Author: sickn33

Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Build GitHub Actions Workflows

Creating reliable CI/CD workflows requires careful triggers, permissions, caching, secrets, and deployment controls. This skill provides adaptable patterns for testing, containers, Kubernetes, matrices, scanning, and approvals.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "github-actions-templates" from https://skillstore.io/skills/sickn33-github-actions-templates.md and its manifest at https://skillstore.io/api/skills/sickn33-github-actions-templates/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-github-actions-templates.md Signed manifest GET /api/skills/sickn33-github-actions-templates/manifest Signed lockfile GET /api/skills/sickn33-github-actions-templates/lockfile

Test it

Using "github-actions-templates". Create Node.js CI for versions 18 and 20 with npm caching, linting, tests, and coverage.

Expected outcome:

A pull request workflow outline with a two-version matrix, npm cache configuration, ordered quality checks, and coverage publishing.

Using "github-actions-templates". Build and publish my service image to GitHub Container Registry after changes reach main.

Expected outcome:

A container workflow outline with restricted package permissions, registry authentication, metadata tags, layer caching, and main-branch publishing.

Using "github-actions-templates". Deploy tagged releases to Amazon EKS with approval and short-lived credentials.

Expected outcome:

A protected deployment outline using GitHub OIDC, an AWS role, immutable actions, Kubernetes rollout verification, and failure reporting.

Security Audit

High Risk

v5 • 7/23/2026 Open versioned report

The 26 backtick alerts are Markdown formatting, while the example URL, local workflow path, and scoped GITHUB_TOKEN are benign template constructs. The AWS example promotes long-lived cloud credentials, and mutable third-party action references create a high-confidence CI supply-chain risk. Replace static AWS keys and pin actions before publication.

Files scanned

354

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:77 SKILL.md:284 SKILL.md:297 SKILL.md:328

Mutable Third-Party Actions Create Supply-Chain Risk

The templates execute third-party actions through mutable version and master references. A compromised upstream ref could run attacker-controlled code with workflow tokens or secrets.

The cited lines directly use third-party actions with mutable refs, including two master refs. GitHub Actions resolves those refs to changeable upstream code.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:158

AWS credential environment variables

aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}

The deployment template instructs users to authenticate AWS with a long-lived access key stored in GitHub Secrets. Compromise or accidental exposure grants persistent cloud access.

High

SKILL.md:159

AWS credential environment variables

aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

The template passes a long-lived AWS secret key to a third-party action. An OIDC role would avoid storing persistent cloud credentials in the repository.

Risk Factors

⚙️ External commands (26)

🌐 Network access (1)

SKILL.md:316

📁 Filesystem access (1)

SKILL.md:258

🔑 Env variables (3)

SKILL.md:158 SKILL.md:159 SKILL.md:113

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-github-actions-templates/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-github-actions-templates/security.svg)](https://skillstore.io/skills/sickn33-github-actions-templates?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-github-actions-templates?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-github-actions-templates/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-github-actions-templates.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). github-actions-templates security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-github-actions-templates/audits/5

BibTeX citation

@techreport{sickn33-sickn33-github-actions-templates-2026,
  author = {sickn33},
  title = {github-actions-templates security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/sickn33-github-actions-templates/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-actions-templates security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-github-actions-templates/audits/5"
identifiers:
  - type: other
    value: "skillstore:sickn33-github-actions-templates:audit:5"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

wshobson Recommended

wshobson-github-actions-templates

Skillstore Score 70

Evidence Confidence High

Skillstore usage 16

Updated

2026-08-21

sickn33 Current

sickn33-github-actions-templates

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Add Application CI

Create a pull request workflow that installs dependencies, runs quality checks, tests supported runtimes, and uploads coverage.

Publish and Deploy Services

Adapt container publishing and Kubernetes deployment patterns for a controlled release pipeline.

Introduce Pipeline Scanning

Add filesystem vulnerability scans and publish findings through GitHub security integrations.

Try These Prompts

Create a Test Workflow

Create a GitHub Actions test workflow for [runtime] versions [versions]. Run [install command], [lint command], and [test command] on pull requests.

Build and Publish a Container

Create a workflow that builds [image name] from [context] and publishes it to [registry]. Use least-privilege permissions and branch-based tags.

Design a Reusable Matrix Workflow

Create a reusable workflow for [language] across [operating systems] and [versions]. Define typed inputs, required secrets, caching, tests, and artifact retention.

Secure a Production Deployment

Design a production workflow for [platform]. Use immutable action pins, OIDC authentication, scoped permissions, approvals, concurrency controls, rollback checks, and deployment verification.

Best Practices

Pin third-party actions to reviewed commit SHAs and update them through controlled dependency automation.
Grant each job only required permissions and prefer short-lived OIDC credentials over stored cloud keys.
Validate generated workflows in a nonproduction repository before enabling package publishing or deployment.

Avoid

Do not copy placeholder branches, regions, cluster names, namespaces, or commands into production unchanged.
Do not expose deployment secrets to untrusted pull request workflows or broadly privileged third-party actions.
Do not use mutable master refs or assume major-version tags provide immutable supply-chain protection.

Frequently Asked Questions

Does this skill create complete workflows?

It provides inline patterns that an assistant can adapt. Repository commands, permissions, environments, and secrets still require user input.

Which technology stacks are covered?

Examples cover Node.js, Python, Docker, GitHub Container Registry, AWS EKS, Kubernetes, Trivy, Snyk, and Slack notifications.

Can it create reusable workflows?

Yes. It includes a workflow_call pattern with a typed Node.js version input and a required secret.

Are the examples ready for production?

No. Review action pins, permissions, credentials, commands, environment protection, and repository settings before production use.

How should AWS authentication be configured?

Prefer GitHub OIDC and a narrowly scoped AWS role. Avoid persistent access keys when federation is available.

Are referenced asset files included?

No. The audited package contains only SKILL.md, so the listed asset and reference paths are unavailable.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/github-actions-templates

Ref

88a8e9a07f4c54ab105c1c41b6267c287146b07b

Maintenance freshness

7/26/2026

Usage

9 downloads · 108 views

File structure

📄 SKILL.md