More screenshots

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    Repair GitHub OIDC Trust Subject Claim Mismatch

    1

    Repair GitHub Actions cloud trust policies after a subject-claim mismatch

    $1

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Repair GitHub OIDC Trust Subject Claim Mismatch

    Repair GitHub OIDC Trust Subject Claim Mismatch

    Example session with this skill installed

    A newly reusable workflow uses a different OIDC sub claim than the cloud trust condition.

    Available evidence: OIDC token claims (partial). Additional evidence requested: state and configuration snapshot, error and recovery logs, deployment and alert timeline. Review the case, identify open evidence gaps, and do not invent a live test or production change.

    • Read your context and instructions
    • Compiled the repair github oidc

    Repair GitHub OIDC Trust Subject Claim Mismatch — EVIDENCE-LIMITED REVIEW

    Scenario received

    A newly reusable workflow uses a different OIDC sub claim than the cloud trust condition.

    Source register

    • S1: OIDC token claims — PARTIAL SOURCE PROVIDED.
    • S2: state and configuration snapshot — NOT PROVIDED; REQUIRED TO VERIFY.
    • S3: error and recovery logs — NOT PROVIDED; REQUIRED TO VERIFY.
    • S4: deployment and alert timeline — NOT PROVIDED; REQUIRED TO VERIFY.

    Concrete checks

    1. compare subject and audience against policy conditions — PRELIMINARY, NOT VERIFIED.
    2. check repository environment and workflow reference scope — AWAITING CORROBORATING EVIDENCE.
    3. crosscheck source timestamps identifiers and changed versions — AWAITING CORROBORATING EVIDENCE.
    4. record exceptions and reversible verification gates — AWAITING CORROBORATING EVIDENCE.

    Deliverables / acceptance gates

    • oidc token claims evidence map: DRAFT / INCOMPLETE until evidence is validated.
    • trust mismatch exception register: DRAFT / INCOMPLETE until evidence is validated.
    • bounded policy validation plan: DRAFT / INCOMPLETE until evidence is validated.

    Decision

    INCOMPLETE — HUMAN REVIEW REQUIRED. Confirm dates, IDs, affected scope, owners and acceptance evidence. Do not claim authorization or execution that did not occur.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Manual OIDC trust configuration often fails when GitHub Actions workflows move to reusable templates or different environments. This skill provides an evidence-based forensic review to align GitHub OIDC token claims with cloud provider trust policies.

    What it does

    • Claim comparison maps OIDC token subjects and audience fields directly against existing cloud policy conditions.
    • Scope validation checks repository environments and workflow reference paths to identify where the mismatch occurs.
    • Timeline correlation crosschecks source timestamps and version identifiers to pinpoint exactly when the trust broke.
    • Evidence mapping produces a formal register of trust mismatch exceptions based on provided logs and snapshots.
    • Recovery planning generates a bounded policy validation plan with clear rollback steps and authorization gates.

    How it works

    1. Supply OIDC token claims, state snapshots, and error logs as local text files.
    2. The skill compares the sub and aud claims against your cloud provider's trust conditions.
    3. It classifies every finding as VERIFIED, CONTRADICTED, or UNVERIFIED based on the timestamps and IDs provided.
    4. It outputs an evidence map and a validation plan for your review before any changes are made.

    Frameworks & tools

    This skill is designed for GitHub Actions OIDC integrations with AWS, Azure, Google Cloud, or HashiCorp Vault. It requires raw text logs or configuration snapshots from these environments.

    Why this beats prompting it yourself

    Generic prompts often guess at IAM policy syntax or ignore the nuances of GitHub's job_workflow_ref claim. This skill enforces a strict decision discipline that separates observations from inferences, preventing "hallucinated" fixes that could create security holes.

    Use cases

    • Debugging "OpenIDConnect Error: Guideline validation failed" during deployment.
    • Aligning trust policies after migrating to reusable workflows.
    • Verifying environment-specific claim restrictions for production deployments.
    • Correlating deployment failures with recent changes in GitHub repository runners.

    Known limitations

    Does not perform live cloud API calls. Requires manual provision of log files and policy snapshots. Does not support proprietary hidden credentials.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for LLM Ops.

    Cannot verify inaccessible environments or data not supplied. Missing or contradictory evidence must be marked INCOMPLETE or UNVERIFIED. Owner approval is required for operational or compliance decisions.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 20 days ago

    Permissions

    Read Files

    Provide only evidence you are authorized to share. Treat examples as untrusted case data. Operational changes and external messages require explicit owner approval.

    Listed20 days ago
    Updated9 days ago

    What's inside

    Frequently Asked Questions

    This skill performs a forensic analysis of your OIDC token claims and cloud IAM policies to identify exactly why they don't match, preventing the 'trial and error' approach that often leads to security vulnerabilities.

    It is compatible with any major LLM (like GPT-4, Claude 3, or Gemini) that supports file uploads or long-form text input for processing your logs and policy snapshots.

    You will receive the specialized OIDC diagnostic logic, an evidence-mapping framework, and a template for generating safe, bounded recovery plans for your cloud environment.

    No, this skill is designed for security and privacy; it operates on raw text logs and configuration snapshots you provide rather than requiring direct access to your GitHub or Cloud accounts.

    It specifically addresses mismatches caused by repository renaming, environment-specific restrictions, and the complex `job_workflow_ref` changes that occur when moving to reusable templates.

    New in LLM Ops