agentic-actions-auditor
帮助团队及早发现 CI 中可被注入的攻击向量，提升部署安全性。
可能需要访问私有仓库的工作流文件以完成全面扫描。
静态分析 GitHub Actions 工作流，识别与 AI agent 集成相关的安全风险。
静态审查 GitHub Actions 工作流里与 AI agent（如 Claude Code Action、Gemini CLI、OpenAI Codex 等）相关的安全风险，找出攻击者可控输入如何流向 CI/CD 中的 AI 步骤。适合审查会调用 AI 的 workflow 文件、复用工作流或 composite action，防止 prompt injection、危险 sandbox 配置或通配白名单等问题。能追踪跨文件引用并捕捉隐蔽的代理调用链。
▸ 展开 SKILL.md 英文原文
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.
帮我安装这个 skill：https://raw.githubusercontent.com/trailofbits/skills/main/plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/trailofbits/skills/main/plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md"# Agentic Actions Auditor Static security analysis guidance for GitHub Actions workflows that invoke AI coding agents. This skill teaches you how to discover workflow files locally or from remote GitHub repositories, identify AI action steps, follow cross-file references to composite actions and reusable workflows that may contain hidden AI agents, capture security-relevant configuration, and detect attack vectors where attacker-controlled input reaches an AI agent running in a CI/CD pipeline. ## When to Use - Auditing a repository's GitHub Actions workflows for AI agent security - Reviewing CI/CD configurations that invoke Claude Code Action, Gemini CLI, or OpenAI Codex - Checking whethe