CtrlK
BlogDocsLog inGet started
Tessl Logo

agentic-actions-auditor

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches. AI agents running in CI/CD pipelines.

63

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills/skills/agentic-actions-auditor/SKILL.md

The canonical home for this skill is agentic-actions-auditor in sickn33/agentic-awesome-skills

SKILL.md
Quality
Evals
Security

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-sequenced, actionable audit methodology with concrete commands, field capture tables, and a thorough reporting structure. Its main weakness is progressive disclosure: the body depends on several referenced reference files that are not present in the bundle, so the promised detailed material is unreachable.

Suggestions

Ship the referenced bundle files (references/cross-file-resolution.md, foundations.md, vector-a..i-*.md, action-profiles.md) so the one-level-deep references resolve; without them the detection heuristics and action profiles the body points to are missing.

Tighten the 'Rationalizations to Reject' section into a compact table or shorter bullets to recover token budget without losing the reasoning.

Optionally inline a one-line detection heuristic per vector in the Step 4 table so the skill remains actionable even before the reference files are opened.

DimensionReasoningScore

Conciseness

Mostly efficient: concrete commands, tables, and field lists earn their place, with only minor over-explanation (e.g., the four 'Rationalizations to Reject' prose blocks and some repeated severity guidance) that could be trimmed; not a 5 because that padding is present.

4 / 5

Actionability

Provides copy-paste-ready `gh api` commands, Glob patterns, explicit matching rules, per-action field capture lists, and a structured report format; stops short of 5 because the actual per-vector detection heuristics are delegated to referenced files rather than given inline, leaving a gap in the written guidance.

4 / 5

Workflow Clarity

A clearly sequenced Steps 0-5 methodology with explicit stop conditions ('If no workflow files found... stop'), per-stage summary outputs, remote error handling (401/404/no-dir), and a structured report checklist (5a-5g); read-only analysis so the destructive-feedback-loop cap does not apply.

5 / 5

Progressive Disclosure

Well-signaled one-level-deep references in a 'Detailed References' section (cross-file-resolution.md, foundations.md, vector-{a..i}-*.md, action-profiles.md) with the body acting as an overview; held at 4 rather than 5 because those referenced files are not present in the bundle and the body still inlines ~316 lines.

4 / 5

Total

17

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and highly distinctive with good natural keywords, but it omits any explicit 'when to use' trigger guidance, which caps completeness at 3. A minor wording glitch ('reaches. AI agents') breaks one sentence but does not materially harm clarity.

Suggestions

Add an explicit 'Use when...' clause naming trigger scenarios (e.g., 'Use when auditing GitHub Actions workflows that invoke AI coding agents, or when reviewing CI/CD configs for prompt-injection exposure').

Broaden the action list beyond 'audits' and 'detects' to cover the full workflow (discover workflows, identify AI steps, trace data flow, report findings) for a more comprehensive specificity score.

Fix the broken sentence so it reads 'Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines.'

DimensionReasoningScore

Specificity

Names the domain ('GitHub Actions workflows for security vulnerabilities in AI agent integrations') and enumerates concrete integrations ('Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference') plus a concrete action ('Detects attack vectors where attacker-controlled input reaches AI agents'); falls short of 5 because only two verbs (audits, detects) are given rather than a comprehensive action list.

4 / 5

Completeness

The 'what' is clear and concrete, but there is no 'Use when...' clause or any explicit trigger guidance, so per the rubric cap completeness cannot exceed 3.

3 / 5

Trigger Term Quality

Strong natural keywords a user would say ('GitHub Actions workflows', 'security vulnerabilities', 'Claude Code Action', 'Gemini CLI', 'OpenAI Codex', 'CI/CD pipelines', 'attack vectors'), but a few common phrasings are missing (e.g., 'CI/CD security review', 'workflow security audit') so it is not the comprehensive synonym/extension coverage of a 5.

4 / 5

Distinctiveness Conflict Risk

A clear, narrow niche (AI coding agents inside GitHub Actions CI/CD) with distinct tool-specific triggers and minimal overlap risk with any other skill.

5 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
administrakt0r/AI-Agents-Safe-Coding-Skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.