Max Gorbuk
9645e2f89b
* agentic-actions-auditor: match the pre-v1 claude-code-action inputs
claude-code-action renamed its inputs at v1, per the action's own migration
guide. The skill names only the v1 set, and SKILL.md Step 2 tells the auditor
to ignore the ref after `@`, so a workflow carrying `direct_prompt` presents
no prompt field the skill knows about and no sink is reported.
On main the skill never mentions `direct_prompt`, `override_prompt`,
`custom_instructions` or `disallowed_tools`. Its one use of `allowed_tools`
is a heading debunking it as a security control, not a field to capture.
Both spellings now appear wherever the v1 one did: the prompt-field table
and a mapping table in foundations, the Step 3a capture list, the dangerous
configuration table in action-profiles, and the Vector B, F and H signatures.
* agentic-actions-auditor: say how secrets cross a resolved-file boundary
Step 5b scores severity on secrets availability, and cross-file-resolution.md
covers resolving and input tracing but not this. The two file kinds behave
oppositely and neither can be read off the resolved file alone.
A composite action has no `secrets` context, so a `${{ secrets.NAME }}` inside
one resolves to empty and is a broken workflow rather than an exposure, while a
secret that did arrive is sitting in `inputs.*` where a search for `secrets.`
will not find it. A called workflow under `secrets: inherit` holds every secret
the caller has without declaring any, so an empty `on.workflow_call.secrets` is
not evidence of a callee without secrets. Inheritance stops at the directly
called workflow.
The reusable-workflow trace claimed `has secrets access` from a caller that
showed neither a trigger nor a `secrets:` line. Both appear in the example the
trace reads from.
---------
Co-authored-by: kz-tob <kara.zaffarano@trailofbits.com>
agentic-actions-auditor
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations. Detects misconfigurations and attack vectors specific to Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference when used in CI/CD pipelines.
What It Does
This plugin provides a security audit skill that analyzes GitHub Actions workflow YAML files for vulnerabilities arising from AI agent integrations. It focuses on scenarios where attacker-controlled input (pull request titles, branch names, issue bodies, comments, commit messages, file contents, environment variables) can reach an AI agent running with elevated permissions in CI.
Attack Vectors Detected
The skill checks for nine categories of security issues:
- A. Env Var Intermediary -- Attacker data flows through
env:blocks to AI prompt fields with no visible${{ }}expressions - B. Direct Expression Injection --
${{ github.event.* }}expressions embedded directly in AI prompt fields - C. CLI Data Fetch --
ghCLI commands in prompts fetch attacker-controlled content at runtime - D. PR Target + Checkout --
pull_request_targettrigger combined with checkout of PR head code - E. Error Log Injection -- CI error output or build logs fed to AI prompts carry attacker payloads
- F. Subshell Expansion -- Restricted tools like
echoallow subshell expansion (echo $(env)) bypass - G. Eval of AI Output -- AI response flows to
eval,exec, or unquoted$()in subsequent steps - H. Dangerous Sandbox Configs --
danger-full-access,Bash(*),--yolodisable safety protections - I. Wildcard Allowlists --
allowed_non_write_users: "*"orallow-users: "*"permit any user to trigger
Supported AI Actions
| Action | Repository | Notes |
|---|---|---|
| Claude Code Action | anthropics/claude-code-action | |
| Gemini CLI | google-github-actions/run-gemini-cli | Primary |
| Gemini CLI (legacy) | google-gemini/gemini-cli-action | Archived |
| OpenAI Codex | openai/codex-action | |
| GitHub AI Inference | actions/ai-inference |
Installation
From a project with the Trail of Bits internal marketplace configured:
/plugin menu
Select agentic-actions-auditor from the Security Tooling section.
Skills Included
| Skill | Description |
|---|---|
| agentic-actions-auditor | Audits GitHub Actions workflow files for AI agent security vulnerabilities |
Target Audience
- Security auditors reviewing repositories that use AI agents in CI/CD
- Developers configuring Claude Code Action, Gemini CLI, OpenAI Codex, or GitHub AI Inference in their workflows
- DevSecOps engineers establishing secure defaults for AI-assisted code review pipelines
Usage
Once installed, the skill activates automatically when Claude detects GitHub Actions workflow files (.github/workflows/*.yml) containing AI agent action references. You can also invoke it directly:
Audit the GitHub Actions workflows in this repository for AI agent security issues.
The skill produces a structured findings report covering each applicable attack vector with severity ratings and remediation guidance.