# agentic-actions-auditor

> Claude/Codex skill by [@trailofbits](https://omgskills.com/library/trailofbits/index.md) · 7.9k stars · Updated 2026-10-28

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.

Tags: agent-skills

## Install

```sh
git clone https://github.com/trailofbits/skills /tmp/skills && ln -s /tmp/skills/plugins/agentic-actions-auditor/skills/agentic-actions-auditor ~/.claude/skills/agentic-actions-auditor
```

## From README

Agentic Actions Auditor Static security analysis guidance for GitHub Actions workflows that invoke AI coding agents. This skill teaches you how to discover workflow files locally or from remote GitHub repositories, identify AI action steps, follow cross-file references to composite actions and reusable workflows that may contain hidden AI agents, capture security-relevant configuration, and detect attack vectors where attacker-controlled input reaches an AI agent running in a CI/CD pipeline.

## Links

- HTML page: https://omgskills.com/library/trailofbits/skills/agentic-actions-auditor/
- GitHub: https://github.com/trailofbits/skills
- Author: [@trailofbits](https://omgskills.com/library/trailofbits/index.md)

## More from this repo

- [address-sanitizer](https://omgskills.com/library/trailofbits/skills/address-sanitizer/index.md) — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during...
   - [@trailofbits](https://omgskills.com/library/trailofbits/index.md) · 8.1k stars
- [aflpp](https://omgskills.com/library/trailofbits/skills/aflpp/index.md) — Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.
   - [@trailofbits](https://omgskills.com/library/trailofbits/index.md) · 7.9k stars
- [algorand-vulnerability-scanner](https://omgskills.com/library/trailofbits/skills/algorand-vulnerability-scanner/index.md) — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees,...
   - [@trailofbits](https://omgskills.com/library/trailofbits/index.md) · 7.9k stars