gh-actions-validator

Validate use when validating GitHub Actions workflows for Google Cloud and Vertex AI deployments. Trigger with phrases like "validate github actions", "setup workload identity federation", "github actions security", "deploy agent with ci/cd", or "automate vertex ai deployment". Enforces Workload Identity Federation (WIF), validates OIDC permissions, ensures least privilege IAM, and implements security best practices.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./plugins/devops/jeremy-github-actions-gcp/skills/gh-actions-validator/SKILL.md

Quality

Content

50%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured and concise but suffers from vague, non-executable instructions, a broken Output snippet, missing validation feedback loops, and a dangling reference to a non-existent docs file while overlooking bundled scripts.

Suggestions

Replace the vague instruction steps with concrete, executable commands and reference the bundled scripts/validate-workflow.sh and scripts/setup-wif.sh directly.

Fix or remove the broken 'Output' YAML fragment so it is a complete, copy-paste-ready WIF auth + deploy example, or move it to references/examples.md.

Add explicit validation checkpoints (e.g., run validate-workflow.sh, review findings, fix, re-run) to give the audit workflow a validate-fix-retry feedback loop.

Remove the reference to the non-existent docs/wif-setup.md or create that file so all signaled paths resolve.

Dimension	Reasoning	Score
Conciseness	Mostly lean without explaining concepts Claude knows, but the 'Output' section is a broken YAML fragment ('--project=${{ secrets.GCP_PROJECT_ID }}' dangling, missing run: blocks) that does not earn its tokens.	2 / 3
Actionability	Instructions are vague ('Scan .github/workflows/ for security issues', 'Ensure no JSON service account keys are used') with no executable commands in the body, and the 'Output' snippet is incomplete rather than copy-paste ready.	2 / 3
Workflow Clarity	Eight steps are sequenced but lack validation checkpoints or feedback loops, and this audit/security skill touches destructive-adjacent operations (IAM, deployments) which caps workflow clarity at 2.	2 / 3
Progressive Disclosure	References to errors.md and examples.md are clearly signaled and one level deep, but the body references a non-existent docs/wif-setup.md and never mentions the bundled scripts/setup-wif.sh or validate-workflow.sh.	2 / 3
	Total	8 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with concrete capabilities, explicit 'Use when' trigger guidance, and natural user-facing trigger phrases. No significant weaknesses.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions: 'Enforces Workload Identity Federation (WIF), validates OIDC permissions, ensures least privilege IAM, and implements security best practices.'	3 / 3
Completeness	Explicitly answers both what (validate/harden GitHub Actions workflows for GCP/Vertex AI via WIF) and when ('Use when validating GitHub Actions workflows... Trigger with phrases like...').	3 / 3
Trigger Term Quality	Provides natural trigger phrases users would say, e.g. 'validate github actions', 'setup workload identity federation', 'github actions security', 'deploy agent with ci/cd', 'automate vertex ai deployment'.	3 / 3
Distinctiveness Conflict Risk	Clear niche combining GitHub Actions with GCP/Vertex AI WIF security, with distinct triggers unlikely to collide with other skills.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: jeremylongshore/claude-code-plugins-plus-skills
Path: plugins/devops/jeremy-github-actions-gcp/skills/gh-actions-validator/SKILL.md
Commit: 399d94c

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.