agentic-actions-auditor

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches. AI agents running in CI/CD pipelines.

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/agentic-actions-auditor/SKILL.md

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, highly actionable static-analysis methodology with concrete commands, explicit workflow checkpoints, and a sound progressive-disclosure structure. Its main weakness is that the referenced {baseDir}/references/*.md files do not exist on disk, so the well-signaled reference links would not resolve.

Suggestions

Ship the referenced bundle files (references/foundations.md, references/vector-a..i-*.md, references/action-profiles.md, references/cross-file-resolution.md) so the well-signaled links actually resolve.

Verify the {baseDir} placeholder renders to a real path at skill-load time, or replace it with a relative path the harness can resolve.

Consider moving the long per-action field-capture lists (Step 3a) into action-profiles.md to further slim the SKILL.md overview.

Dimension	Reasoning	Score
Conciseness	The body is dense and assumes Claude's competence, avoiding generic explanations of what GitHub Actions or AI agents are, with only minor sections (the long per-field capture lists) that could be trimmed.	4 / 5
Actionability	Provides copy-paste-ready `gh api` commands, concrete Glob patterns, an exact action-reference table with matching rules, per-action field capture lists, and a fully specified report template covering common cases.	5 / 5
Workflow Clarity	Steps 0-5 are clearly sequenced with each building on the previous, including explicit validation checkpoints (stop if no workflow files, stop if no AI actions, 401/404 error handling, depth-1 resolution limits) and feedback loops for error recovery.	5 / 5
Progressive Disclosure	Follows a clean overview-plus-one-level-deep-references pattern with a dedicated 'Detailed References' section pointing to vector, foundations, action-profiles, and cross-file-resolution files, but those referenced files are not present in the bundle so navigation would break.	4 / 5
	Total	18 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, naming concrete integrations and attack-vector detection, but lacks an explicit 'Use when...' trigger clause, which caps its completeness. A minor formatting artifact ('input reaches. AI agents') breaks a sentence mid-stream due to YAML folding.

Suggestions

Add an explicit 'Use when...' clause listing natural trigger phrases (e.g., 'Use when auditing GitHub Actions workflows that invoke Claude Code Action, Gemini CLI, OpenAI Codex, or GitHub AI Inference for security').

Fix the broken sentence ('input reaches. AI agents') so the description reads as one coherent statement after YAML folding.

Include natural synonyms/file extensions (e.g., '.github/workflows/*.yml', 'CI/CD pipelines', 'pull_request_target') to broaden trigger term coverage.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete actions ('Audits GitHub Actions workflows for security vulnerabilities', 'Detects attack vectors where attacker-controlled input reaches AI agents') and enumerates four specific integrations, sitting above the 3-anchor with minor coverage gaps.	4 / 5
Completeness	Has a clear 'what' but no explicit 'Use when...' trigger clause, which per the judging guidelines caps completeness at 3 even though the capability description is clear.	3 / 5
Trigger Term Quality	Strong natural keyword coverage including 'GitHub Actions workflows', 'Claude Code Action', 'Gemini CLI', 'OpenAI Codex', and 'CI/CD pipelines' that users would actually name, missing only synonyms and file extensions.	4 / 5
Distinctiveness Conflict Risk	Targets a clear niche (security auditing of AI-agent GitHub Actions integrations) with named, distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: sickn33/antigravity-awesome-skills
Path: skills/agentic-actions-auditor/SKILL.md
Commit: 1f67c44

Reviewed: about 16 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.