1. Habit
  2. Skills
  3. GHA Security Review skill
getsentry · 5K installs

GHA Security Review skill
Runs by itself, workflow file changes.

Exploitable workflow bugs caught before merge.

Install the GHA Security Review skill and make it a habit: follow https://gethabit.dev/skills/getsentry/gha-security-review.md

  1. 1Copy
  2. 2Paste into Claude Code, Codex or Cursor
  3. 3It runs by itself

5K installs1K starsApache-2.0 licenceSource on GitHub ↗

GHA Security Review

by getsentry · 5K installs

The skill

Gha security review audits GitHub Actions workflows for exploitable bugs like pwn requests, expression injection, credential theft and supply chain attacks, reporting only traced findings with concrete exploit scenarios.

Only when you ask.

The habit

Exploitable workflow bugs caught before merge.

↻ Runs by itselfworkflow file changes

How the habit works.
You don't have to.

Three questionsWhen does it start? How does it check its work? What does it remember?

01

It starts by itself

workflow file changes. Runs in GitHub Actions or Claude Code routine.

  • ↻ workflow file changes
  • pull_request paths: .github/workflows/**, action.yml

02

It checks its work

traced findings only. If a check fails, it tells you.

  • ✓every HIGH finding has entry point, payload, execution, impact and PoC sketch
  • ✓every reviewed workflow appears under findings or reviewed and cleared
  • ✓the count of HIGH findings is zero

03

It remembers

workflow review log. The next run reads it first: open findings and workflows already cleared.

loops/gha-workflow-security-loop/log.md

One run, step by step.
Then it stops.

Stop ruleStops after the changed workflows of one pull request.

  1. 01

    Classify triggers

    List each workflow's triggers and load only the matching references.

  2. 02

    Run the checks

    Check pwn requests, expression injection, comment commands, credentials, config poisoning, supply chain, permissions and runners.

  3. 03

    Skip safe patterns

    Drop patterns the skill lists as safe, like expressions in if: or with: inputs.

  4. 04

    Trace attack paths

    Read the full YAML and confirm trigger, attacker control and missing mitigations.

  5. 05

    Report

    Write findings, needs-verification items and cleared workflows, or report zero findings.

What it may do.
Nothing more.

Safe by defaultIt writes only in its own folder and asks you before anything goes out.

Is it for you?
Use it when it fits.

Quick checkRead both lists. If the left one sounds like you, the GHA Security Review skill helps.

Use it when

  • ✓ You review GitHub Actions workflows
  • ✓ You add a pull_request_target job
  • ✓ You audit CI before release

Skip it when

  • – You need a general code review
  • – Your CI is not GitHub Actions

Questions

GHA Security Review skill, answered.

Does it flag issues that need write access?

No. The threat model covers only external attackers without write access.

Will it flag actions/checkout on a version tag?

No. First-party actions on version tags are outside the pinning policy.

What if nothing is found?

It reports zero findings and does not invent issues.

How do I install the GHA Security Review skill?

Copy the prompt at the top into your agent. It installs the skill from getsentry/skills and sets up the habit. Or run npx skills add getsentry/skills --skill gha-security-review.

Is the GHA Security Review skill free?

Yes. It is published under Apache-2.0. Habit is free too.

GHA Security Review. Now as a habit.

Install the GHA Security Review skill and make it a habit: follow https://gethabit.dev/skills/getsentry/gha-security-review.md

  • Free
  • No account
  • Undo in one line

All getsentry skills →More code skills →

Works in

  • Claude Code
  • Codex
  • Cursor
  • ChatGPT
  • Claude app

Made by getsentry, published under Apache-2.0. Habit links to the original and never changes it. Is this your skill?

Copying didn't work here. Select the line and copy it by hand.