---
title: "GitHub Actions Security Review"
type: skill
id: "sentry-skills/security-checks/gha-security-review"
category: "Security"
publisher: "Sentry"
license: "Apache-2.0"
source: "https://github.com/getsentry/skills/tree/0c464f4"
canonical: "https://labs.pho.chat/en/skills/sentry-skills/security-checks/gha-security-review"
open_in_pho: "https://pho.chat/customize?item=sentry-skills%2Fsecurity-checks%2Fgha-security-review&utm_source=labs&utm_medium=skill-page&utm_campaign=skills-library"
---

# GitHub Actions Security Review

GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.

Source: Sentry (Apache 2.0), copied at a pinned commit. Free to use. Part of the Phở Skills library (https://labs.pho.chat/en/skills).
Skill set: Sentry security checks (https://labs.pho.chat/en/skills/sentry-skills/security-checks.md).

## What it covers
- Scope
  - Files to Review
  - Out of Scope
- Threat Model
- Confidence
- Step 1: Classify Triggers and Load References
- Step 2: Check for Vulnerability Classes
  - Check 1: Pwn Request
  - Check 2: Expression Injection
  - Check 3: Unauthorized Command Execution
  - Check 4: Credential Escalation
  - Check 5: Config File Poisoning
  - Check 6: Supply Chain
  - Check 7: Permissions and Secrets
  - Check 8: Runner Infrastructure
- Safe Patterns (Do Not Flag)
- Step 3: Validate Before Reporting
- Step 4: Report Findings

## Other skills in this set
- [Secret Serialization Review](https://labs.pho.chat/en/skills/sentry-skills/security-checks/secret-serialization.md): Finds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs, pydantic model_dump, NamedTuple, JavaScript JSON.stringify and…

## Use it
- In Phở: open https://pho.chat/customize?item=sentry-skills%2Fsecurity-checks%2Fgha-security-review&utm_source=labs&utm_medium=skill-page&utm_campaign=skills-library and press Try, or add it so Phở loads it whenever a request matches. Phở works with your own API key (OpenAI, Anthropic, Google and others).
- Full instructions (original SKILL.md, unchanged): https://labs.pho.chat/skills/raw/sentry-skills/security-checks/skills/gha-security-review/SKILL.md
- Original files: https://github.com/getsentry/skills/tree/0c464f4 (Apache 2.0).
- Full machine-readable index: https://labs.pho.chat/skills.json