📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills github-actions-templates
📦
github-actions-templates
Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Build GitHub Actions Workflows
Creating reliable CI/CD workflows requires careful triggers, permissions, caching, secrets, and deployment controls. This skill provides adaptable patterns for testing, containers, Kubernetes, matrices, scanning, and approvals.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "github-actions-templates" from https://skillstore.io/skills/sickn33-github-actions-templates.md and its manifest at https://skillstore.io/api/skills/sickn33-github-actions-templates/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "github-actions-templates". Create Node.js CI for versions 18 and 20 with npm caching, linting, tests, and coverage.
Expected outcome:
A pull request workflow outline with a two-version matrix, npm cache configuration, ordered quality checks, and coverage publishing.
Using "github-actions-templates". Build and publish my service image to GitHub Container Registry after changes reach main.
Expected outcome:
A container workflow outline with restricted package permissions, registry authentication, metadata tags, layer caching, and main-branch publishing.
Using "github-actions-templates". Deploy tagged releases to Amazon EKS with approval and short-lived credentials.
Expected outcome:
A protected deployment outline using GitHub OIDC, an AWS role, immutable actions, Kubernetes rollout verification, and failure reporting.
Security Audit
High Riskv5 • 7/23/2026 Open versioned report
The 26 backtick alerts are Markdown formatting, while the example URL, local workflow path, and scoped GITHUB_TOKEN are benign template constructs. The AWS example promotes long-lived cloud credentials, and mutable third-party action references create a high-confidence CI supply-chain risk. Replace static AWS keys and pin actions before publication.
1
Files scanned
354
Lines analyzed
2
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Mutable Third-Party Actions Create Supply-Chain Risk
The templates execute third-party actions through mutable version and master references. A compromised upstream ref could run attacker-controlled code with workflow tokens or secrets.
The cited lines directly use third-party actions with mutable refs, including two master refs. GitHub Actions resolves those refs to changeable upstream code.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
AWS credential environment variables
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
The deployment template instructs users to authenticate AWS with a long-lived access key stored in GitHub Secrets. Compromise or accidental exposure grants persistent cloud access.
High
AWS credential environment variables
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
The template passes a long-lived AWS secret key to a third-party action. An OIDC role would avoid storing persistent cloud credentials in the repository.
Risk Factors
⚙️ External commands (26)
SKILL.md:23 SKILL.md:41-80 SKILL.md:80-82 SKILL.md:82-86 SKILL.md:86-135 SKILL.md:135-137 SKILL.md:137-141 SKILL.md:141-176 SKILL.md:176-180 SKILL.md:180-209 SKILL.md:209-211 SKILL.md:211-228 SKILL.md:228-252 SKILL.md:252-255 SKILL.md:255-263 SKILL.md:263-267 SKILL.md:267-300 SKILL.md:300-304 SKILL.md:304-335 SKILL.md:335-339 SKILL.md:339-340 SKILL.md:340-341 SKILL.md:341-342 SKILL.md:342-346 SKILL.md:346-347 SKILL.md:347-348
🌐 Network access (1)
📁 Filesystem access (1)
🔑 Env variables (3)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-github-actions-templates/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-github-actions-templates?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-github-actions-templates?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-github-actions-templates/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-github-actions-templates.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). github-actions-templates security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-github-actions-templates/audits/5BibTeX citation
@techreport{sickn33-sickn33-github-actions-templates-2026,
author = {sickn33},
title = {github-actions-templates security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-github-actions-templates/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-actions-templates security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-github-actions-templates/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-github-actions-templates:audit:5"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Highest Skillstore Score
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
wshobson Recommended
wshobson-github-actions-templates
Skillstore Score 70
Evidence Confidence High
Skillstore usage 16
Updated
2026-08-21
sickn33 Current
sickn33-github-actions-templates
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 11
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Add Application CI
Create a pull request workflow that installs dependencies, runs quality checks, tests supported runtimes, and uploads coverage.
Publish and Deploy Services
Adapt container publishing and Kubernetes deployment patterns for a controlled release pipeline.
Introduce Pipeline Scanning
Add filesystem vulnerability scans and publish findings through GitHub security integrations.
Try These Prompts
Create a Test Workflow
Create a GitHub Actions test workflow for [runtime] versions [versions]. Run [install command], [lint command], and [test command] on pull requests.
Build and Publish a Container
Create a workflow that builds [image name] from [context] and publishes it to [registry]. Use least-privilege permissions and branch-based tags.
Design a Reusable Matrix Workflow
Create a reusable workflow for [language] across [operating systems] and [versions]. Define typed inputs, required secrets, caching, tests, and artifact retention.
Secure a Production Deployment
Design a production workflow for [platform]. Use immutable action pins, OIDC authentication, scoped permissions, approvals, concurrency controls, rollback checks, and deployment verification.
Best Practices
- Pin third-party actions to reviewed commit SHAs and update them through controlled dependency automation.
- Grant each job only required permissions and prefer short-lived OIDC credentials over stored cloud keys.
- Validate generated workflows in a nonproduction repository before enabling package publishing or deployment.
Avoid
- Do not copy placeholder branches, regions, cluster names, namespaces, or commands into production unchanged.
- Do not expose deployment secrets to untrusted pull request workflows or broadly privileged third-party actions.
- Do not use mutable master refs or assume major-version tags provide immutable supply-chain protection.
Frequently Asked Questions
Does this skill create complete workflows?
It provides inline patterns that an assistant can adapt. Repository commands, permissions, environments, and secrets still require user input.
Which technology stacks are covered?
Examples cover Node.js, Python, Docker, GitHub Container Registry, AWS EKS, Kubernetes, Trivy, Snyk, and Slack notifications.
Can it create reusable workflows?
Yes. It includes a workflow_call pattern with a typed Node.js version input and a required secret.
Are the examples ready for production?
No. Review action pins, permissions, credentials, commands, environment protection, and repository settings before production use.
How should AWS authentication be configured?
Prefer GitHub OIDC and a narrowly scoped AWS role. Avoid persistent access keys when federation is available.
Are referenced asset files included?
No. The audited package contains only SKILL.md, so the listed asset and reference paths are unavailable.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/github-actions-templatesRef
88a8e9a07f4c54ab105c1c41b6267c287146b07b
Maintenance freshness
7/26/2026
Usage
9 downloads · 108 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-fullstack
82Build Fullstack Apps with Senior Patterns
Teams need consistent setup, architecture, and review guidance for modern web applications. This skill provides scaffolders, workflow references, and quality prompts for React, Next.js, Node.js, GraphQL, and PostgreSQL projects.
Coding & Development View
📦
senior-architect
81Design Scalable Software Architectures
Architecture decisions are hard to compare across web, mobile, backend, and cloud systems. This skill provides structured guides and local scaffold scripts for reports, dependency review, and trade-off documentation.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
senior-devops
81Automate DevOps Pipelines and Deployments
by alirezarezvani
DevOps work often requires repeatable pipeline, infrastructure, and deployment patterns. This skill provides scripts and reference guides for CI/CD, IaC, deployment, and operations review.
DevOps & Infrastructure View
📦
helm-chart-architect
80Design Production Helm Chart Architecture
by 92Bilal26
Teams often copy Helm examples that do not match their operational constraints. This skill guides chart architecture through dependencies, hooks, values, environments, and operator needs.
DevOps & Infrastructure View
📦
devops-orchestrator
79Coordinate DevOps Delivery
by Brownbull
DevOps work often spans pipelines, infrastructure, monitoring, and deployment decisions. This skill organizes those tasks into checklists, handoffs, and rollout plans.
DevOps & Infrastructure View
📦
ml-pipeline-workflow
79Build Production ML Pipelines
by wshobson
ML teams need repeatable pipelines that connect data preparation, training, validation, deployment, and monitoring. This skill guides Claude, Codex, and Claude Code through practical MLOps workflow design.
DevOps & Infrastructure View
📦
deployment-pipeline-design
78Design Safer CI/CD Deployment Pipelines
by wshobson
Teams often ship through pipelines that lack clear gates, rollback plans, or production checks. This skill guides Claude, Codex, and Claude Code to design staged deployment workflows with approvals, strategies, and verification.
DevOps & Infrastructure View
📦
istio-traffic-management
78Manage Istio Traffic Policies
by wshobson
Service mesh routing can be difficult to configure safely across many services. This skill provides Istio templates and guidance for routing, canary releases, retries, load balancing, gateways, and resilience controls.
DevOps & Infrastructure View