An issue title pasted into a run script with ${{ }} can run any command in your workflow, with your secrets. This skill finds that, pull_request_target jobs that run a fork's code, and seven other workflow risks, and tells you how to fix each one.

Your agent runs a scanner on the workflow files in .github/workflows (or one file you name). It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach for every finding.

What it checks

BLOCK (fix before shipping)

• G01: a pull_request_target workflow that checks out the pull request's code

• G02: issue, PR, comment or branch text pasted into a run script with ${{ }}

• G03: a GitHub, GitLab, Slack or AWS token written in the workflow

REVIEW (check before release)

• G11: a third-party action not pinned to a full commit SHA

• G12: permissions: write-all

• G13: no permissions block

• G14: a secret pasted straight into a run script

• G16: a self-hosted runner on pull request triggers

• G17: a download piped into a shell

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• Risky and safe example workflows, and the real report the scanner produces on the risky ones

Limits

It reads workflow YAML line by line. It does not resolve reusable workflows, composite actions or YAML anchors, and it cannot see repository settings. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 8 files: SKILL.md, the scanner in scripts/ (2 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (3 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.