agentic-actions-auditor

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches. AI agents running in CI/CD pipelines.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/agentic-actions-auditor/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-structured, actionable audit methodology with strong workflow sequencing and concrete detection patterns. Its main weakness is progressive disclosure: the body points to numerous reference files that are not present in the skill bundle.

Suggestions

Ship the referenced `references/*.md` files (vector-a..i, foundations, action-profiles, cross-file-resolution) or inline the essential detection heuristics so the methodology is self-contained.

Trim the 'Rationalizations to Reject' section to a brief bullet list of the fallacies, keeping only the actionable refutations.

Consolidate the per-vector Quick Check column with inline detection snippets so analysts can apply the heuristics without opening each reference file.

Dimension	Reasoning	Score
Conciseness	The body is dense and procedural, assuming Claude's knowledge of GitHub Actions and YAML without padding, though the 'Rationalizations to Reject' section adds some justification prose that could be trimmed.	4 / 5
Actionability	Provides executable `gh api` commands, per-action security field lists, and a concrete vector-detection table with exact patterns (`${{ github.event.* }}`, `danger-full-access`, `Bash(*)`), with minor gaps deferred to referenced files.	4 / 5
Workflow Clarity	A clearly sequenced 0→5 methodology with explicit stop conditions and error-handling checkpoints (401/404 auth, 'If no workflow files found... stop'), though some validation detail lives in referenced files rather than inline.	4 / 5
Progressive Disclosure	The body clearly signals one-level-deep references to `{baseDir}/references/*.md` (vector files, foundations, action-profiles, cross-file-resolution), but the `references/` directory is absent from the bundle, so those references cannot actually be followed.	3 / 5
	Total	15 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive with strong trigger terms, but it lacks an explicit 'Use when...' clause, leaving the use-case trigger implicit and capping completeness. The malformed sentence break ('reaches. AI agents running...') slightly weakens clarity.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when auditing GitHub Actions workflows that invoke AI coding agents (Claude Code Action, Gemini CLI, OpenAI Codex, GitHub AI Inference) for security vulnerabilities.'

Fix the broken sentence spanning the description ('reaches. AI agents running in CI/CD pipelines') so it reads as one coherent statement.

Add a synonym such as 'CI/CD pipeline security' to broaden natural trigger coverage.

Dimension	Reasoning	Score
Specificity	States concrete actions ('Audits GitHub Actions workflows for security vulnerabilities', 'Detects attack vectors where attacker-controlled input reaches') and names several specific AI actions, but coverage of distinct verbs is narrow (audits/detects).	4 / 5
Completeness	Clearly states what the skill does but provides no 'Use when...' trigger clause, so 'when' is only weakly implied — capping completeness at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Includes natural terms a user would say ('GitHub Actions workflows', 'security vulnerabilities', 'Claude Code Action', 'Gemini CLI', 'OpenAI Codex') but omits common synonyms like 'CI/CD security'.	4 / 5
Distinctiveness Conflict Risk	Targets a clear niche (AI agent integrations in GitHub Actions workflows) with named actions and named attack vectors, giving minimal overlap with other skills.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: sickn33/agentic-awesome-skills
Path: skills/agentic-actions-auditor/SKILL.md
Commit: b1aebac

Reviewed: ~18 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.