Skip to content

Phở Founder Lifetime: $59 once, 1 year of Phở AI included. Limited seats. See the offer

Security · Skill

GitHub Actions Security Review

GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.

Open in Phở

What the skill covers

The sections of its instructions, in order.

  1. 01 Scope
  2. Files to Review
  3. Out of Scope
  4. 02 Threat Model
  5. 03 Confidence
  6. 04 Step 1: Classify Triggers and Load References
  7. 05 Step 2: Check for Vulnerability Classes
  8. Check 1: Pwn Request
  9. Check 2: Expression Injection
  10. Check 3: Unauthorized Command Execution
  11. Check 4: Credential Escalation
  12. Check 5: Config File Poisoning
  13. Check 6: Supply Chain
  14. Check 7: Permissions and Secrets
  15. Check 8: Runner Infrastructure
  16. 06 Safe Patterns (Do Not Flag)
  17. 07 Step 3: Validate Before Reporting
  18. 08 Step 4: Report Findings

Reference files

9 files Phở can open while it uses the skill.

  • references/ai-prompt-injection-via-ci.md
  • references/comment-triggered-commands.md
  • references/credential-escalation.md
  • references/expression-injection.md
  • references/permissions-and-secrets.md
  • references/pwn-request.md
  • references/real-world-attacks.md
  • references/runner-infrastructure.md
  • references/supply-chain.md

More in Sentry security checks

  • Secret Serialization Review

    Finds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs, pydantic model_dump, NamedTuple, JavaScript…

Similar security skills

Frequently asked questions

What does GitHub Actions Security Review do?

GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.

Is GitHub Actions Security Review free to use?

Yes. GitHub Actions Security Review is published by Sentry under the Apache 2.0 licence, and you can use it with a free Phở account.

How do I use GitHub Actions Security Review in Phở?

Press Open in Phở, then Try to apply it to your next message, or add the Sentry security checks set so Phở loads it whenever a request matches.

Does GitHub Actions Security Review need other tools?

No. It works in a normal Phở chat with what you type or upload.

Copied unchanged from getsentry/skills at commit 0c464f4 and credited to Sentry, who is not affiliated with Phở. The full instructions and licence text ship with the skill inside Phở.