📦

Audit History

github-actions-templates - 5 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v5 LatestJul 23, 2026, 11:47 PM 1 confirmed2No capability change
v4 Jul 8, 2026, 10:50 AM 1 confirmed0No capability change
v3 Jul 5, 2026, 11:48 PM 1 confirmed0No capability change
v2 Jun 30, 2026, 03:52 PM 1 confirmed2External commandsNetwork accessFilesystem accessEnv variables
v1 Feb 25, 2026, 02:40 AM No confirmed findings0Baseline

Jul 23, 2026, 11:47 PM

The 26 backtick alerts are Markdown formatting, while the example URL, local workflow path, and scoped GITHUB_TOKEN are benign template constructs. The AWS example promotes long-lived cloud credentials, and mutable third-party action references create a high-confidence CI supply-chain risk. Replace static AWS keys and pin actions before publication.

1
Files scanned
354
Lines analyzed
7
Review items
0
False positives ignored

Confirmed security concerns (1)

High
Mutable Third-Party Actions Create Supply-Chain Risk
The templates execute third-party actions through mutable version and master references. A compromised upstream ref could run attacker-controlled code with workflow tokens or secrets.
The cited lines directly use third-party actions with mutable refs, including two master refs. GitHub Actions resolves those refs to changeable upstream code.
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
AWS credential environment variables
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
The deployment template instructs users to authenticate AWS with a long-lived access key stored in GitHub Secrets. Compromise or accidental exposure grants persistent cloud access.
High
AWS credential environment variables
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
The template passes a long-lived AWS secret key to a third-party action. An OIDC role would avoid storing persistent cloud credentials in the repository.
Audited by: codex

Jul 8, 2026, 10:50 AM

Static detections are mostly false positives from Markdown code fences, template paths, and GitHub Actions secret placeholders. No prompt injection, data exfiltration intent, or skill runtime command execution was found in SKILL.md. One semantic issue remains: security scan examples use mutable third-party action refs that should be pinned.

1
Files scanned
354
Lines analyzed
5
Review items
0
False positives ignored

Confirmed security concerns (1)

Medium
Mutable Third-Party Action References
The security scanning workflow uses third-party actions from mutable master branches. Those refs can change without review and execute code in CI.
The template directly shows external actions using @master refs. This is a known CI supply-chain risk and is not covered by the static hardcoded URL finding.
Audited by: codex

Jul 5, 2026, 11:48 PM

The static command, filesystem, network, and token matches are documentation examples or placeholders in SKILL.md, not executable skill behavior. The main confirmed issue is a semantic workflow security concern: mutable @master action references in the security scanning template. Authors should pin actions, prefer short-lived cloud authentication, and include or remove missing referenced assets.

1
Files scanned
346
Lines analyzed
5
Review items
0
False positives ignored

Confirmed security concerns (1)

High
Mutable GitHub Action References
The security scanning workflow recommends aquasecurity/trivy-action@master and snyk/actions/node@master. Mutable branch references can change without review and create supply-chain risk if copied into production workflows.
The file explicitly uses two third-party actions pinned to the mutable master branch in a security workflow example. This conflicts with the nearby best practice to use specific action versions.
Audited by: codex

Jun 30, 2026, 03:52 PM

The static command-execution and credential findings are mostly false positives from Markdown GitHub Actions examples. A real medium-risk issue remains because two third-party Actions are pinned to master, which can change without review.

1
Files scanned
346
Lines analyzed
7
Review items
3
False positives ignored

Confirmed security concerns (1)

Medium
Unpinned Third-Party GitHub Actions
The security scan examples use aquasecurity/trivy-action@master and snyk/actions/node@master. Branch references can change without review and may introduce supply-chain risk in generated workflows.
The lines directly reference third-party Actions through the mutable master branch. This is a known CI supply-chain risk, although it appears to be an insecure template choice rather than malicious intent.
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low
Workflow Secret Placeholders Are Documented Examples
The GitHub and AWS token references use GitHub Actions secrets syntax in workflow templates. This is expected for CI/CD examples, but users must manage these secrets securely.
The credential references are placeholders under GitHub Actions with: blocks. I found no evidence that the skill reads or exfiltrates local environment variables.
Low
Hidden GitHub Workflow Path Is Expected
The hidden path detection points to ./.github/workflows/reusable-test.yml. This is the standard location for reusable GitHub Actions workflows.
The path is a conventional repository workflow path. I found no evidence of hidden file harvesting or unauthorized filesystem access.
Static false positives ignored (3)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Markdown Examples Misclassified as Shell Execution
The external command detections occur in Markdown code fences, resource references, or related skill names. I found no evidence that the skill itself executes Ruby, shell commands, or user-controlled input.
The cited lines are documentation or YAML workflow snippets inside SKILL.md. They are not executable code in the skill runtime.
Low
Placeholder Production URL Is Not Exfiltration
The hardcoded URL is a deployment environment example using https://app.example.com. I found no evidence of data transfer to an attacker-controlled endpoint.
The domain is the reserved example.com domain and appears inside a GitHub Actions environment field. It is documentation, not active network code.
Low
Weak Cryptography Detections Are Text Matches
The weak cryptography alerts appear to match ordinary words in the skill description, kubectl describe command, and related skill name. I found no cryptographic implementation.
The cited lines contain prose or Kubernetes commands, not hash, cipher, or signing logic. The static signal is a lexical false positive.

Detected Patterns

Mutable Action Version References
Audited by: codex

Feb 25, 2026, 02:40 AM

This skill is documentation-only containing GitHub Actions YAML workflow templates. All static analysis findings are false positives: the detected 'external_commands' are YAML run: syntax in markdown code blocks, 'network' references are URL configuration values, 'filesystem' patterns are reusable workflow references, and 'env_access' patterns are GitHub Actions secret syntax (${{ secrets.* }}). No executable code, no prompt injection attempts, and no security risks detected. The skill teaches legitimate DevOps practices including proper secret handling and secure workflow patterns.

1
Files scanned
348
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude