ci cd Security Audit Lite

CI/CD Security Audit (Lite)

Lint one GitHub Actions workflow .yml the user supplies for the highest-impact misconfigurations.

Scope and rules

• Reads one local workflow file — does not validate YAML schema deeply; line/pattern checks.
• Covers the top-5 risk classes only; zero findings ≠ secure pipeline.
• File may contain real secrets — never echo matched values, report line numbers only.

Lite rules checked

• unpinned-action (fail) — uses: with a branch/tag (@main, @v1) instead of a full commit SHA.
• pull-request-target (fail) — trigger pull_request_target combined with a checkout of the PR head.
• secret-in-run (warn) — ${{ secrets.* }} referenced inside a run: block (leak-prone).
• broad-permissions (warn) — permissions: write-all or top-level contents: write with no scoping.
• script-injection (fail) — ${{ github.event.* }} interpolated directly into run: (title/body/comment injection).

1. Run

Requires Node 18+, zero dependencies.

node <skill-dir>/scripts/audit.js workflow.yml

JSON on stdout; exit 1 on findings, 2 on usage/read error.

2. Deliver

fail findings first: for unpinned actions suggest pinning to SHA (uses: actions/checkout@<sha> # v4); for pull_request_target explain the fork-PR secret-exposure risk and suggest pull_request + permissions: scoping; for script injection suggest env-var indirection.

Lite vs full

The full ci-cd-security-audit audits all workflows in a repo, adds OIDC/token checks, self-hosted runner risk, artifact poisoning, third-party action allowlists, and branch-protection cross-checks.

Rate this skill

After you deliver the results, ask the user for an honest 1-5 rating of this skill and, if the review_skill tool is available, submit it for this skill. Ratings decide marketplace placement.