GitHub Actions GITHUB_TOKEN Permission Diff

    1

    Compare two workflow YAML files and review declared GITHUB_TOKEN permission changes before merge.

    $5

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    Security scanned

    Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    GitHub Actions GITHUB_TOKEN Permission Diff

    Example session with this skill installed

    Compare the included invented before.yml and after.yml workflow files. Show the declared permission change at the publish job and the checks a maintainer should do before merging. Do not call GitHub or claim effective token privileges.

    • Read your context and instructions
    • Compiled the github actions github_token

    Synthetic GitHub Actions permission change card

    Scope: only the supplied before.yml and after.yml workflow declarations.

    Status: REVIEW. The examples are invented and no GitHub API was called.

    LocationBefore declarationAfter declarationClassification
    job:publishcontents: readcontents: writeDECLARED_BROADENING

    The workflow-level contents: read declaration remains unchanged. The publish job has its own explicit permission map, so the card highlights that job-level change rather than assuming a live token grant. The output packet includes the before/after file hashes and an integrity receipt so reviewers can tie the card to the exact submitted files.

    Human review queue: Confirm these are the intended versions. Inspect the changed job scope and whether any other job overrides the workflow declaration. Check repository and organization defaults, event and fork behavior, reusable workflows and actual runtime token restrictions separately. Decide whether contents: write is justified for the publish job before merging.

    Limits: This is a static comparison of two supplied YAML files. DECLARED_BROADENING is a prompt for review, not proof that the job can write to the repository. The tool does not execute workflows, connect to GitHub, inspect secrets, or change settings.

    Connects securely to your tools. The creator never sees your data.

    What you get

    Compare top-level and job-level permission declarations in two local workflow filesFlag declared permission broadening for a maintainer before mergeSave a deterministic change card, review checklist and integrity receipt

    About this skill

    A small workflow edit can broaden declared GITHUB_TOKEN permissions at the workflow or job level. This local checker compares before-and-after YAML files and creates a deterministic change card, review checklist and integrity receipt. It does not connect to GitHub, execute a workflow or determine effective repository permissions.

    Give the included local CLI or optional stdio MCP tool before and after copies of one GitHub Actions workflow. It compares top-level and per-job `permissions`, flags changed and potentially broadened declarations, and writes a deterministic change card, human checklist and integrity receipt. The companion SKILL.md guides an assistant through reviewing that card. The ZIP includes readable Python source, a CLI, optional MCP adapter, invented YAML examples and sample output. Python 3.11–3.14 and pinned PyYAML 6.0.3 are required; optional MCP mode also uses mcp==2.2.0. At runtime it does not connect to GitHub, execute jobs, edit workflows or require a token. This is a review queue for declarations in the supplied files, not proof of effective GITHUB_TOKEN rights, security or repository defaults.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 13 days ago

    • Passed all security checks, Safe to install

    Listed13 days ago
    Updated12 days ago

    What's inside

    Frequently Asked Questions