Agentic Actions Auditor
Skill Verifiziert AktivAudits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.
To empower security professionals and developers to audit GitHub Actions workflows for AI agent security vulnerabilities, ensuring CI/CD pipelines are protected against prompt injection and other attack vectors.
Funktionen
- Detects prompt injection via direct expressions, env vars, and CLI fetches.
- Identifies dangerous sandbox configurations and wildcard user allowlists.
- Analyzes cross-file references for hidden AI agents.
- Provides detailed remediation guidance for each attack vector.
- Supports both local and remote repository analysis.
Anwendungsfälle
- Auditing a repository's GitHub Actions workflows for AI agent security.
- Reviewing CI/CD configurations that invoke AI coding agents.
- Evaluating agentic action configurations for security risks.
- Assessing trigger events that expose workflows to external input.
Nicht-Ziele
- Performing runtime prompt injection testing.
- Auto-fixing or modifying workflow files.
- Auditing non-GitHub CI/CD systems.
- Reviewing standalone composite actions outside of a caller workflow context.
Workflow
- Determine analysis mode (local or remote).
- Discover GitHub Actions workflow files.
- Identify AI action steps using `uses:` references.
- Capture security context (trigger events, env vars, permissions).
- Analyze for specific attack vectors (env var intermediary, direct injection, etc.).
- Report findings with detailed evidence, data flow, and remediation.
Praktiken
- Security Auditing
- CI/CD Security
- Prompt Injection Detection
- Static Analysis
Voraussetzungen
- GitHub CLI (`gh`) installed and authenticated
- Access to the GitHub repository being audited
Installation
Zuerst Marketplace hinzufügen
/plugin marketplace add trailofbits/skills/plugin install agentic-actions-auditor@trailofbitsQualitätspunktzahl
VerifiziertVertrauenssignale
Ähnliche Erweiterungen
Ship Gate
100Pre-production audit that scans a codebase for security, database, deployment, code quality, AI/LLM, dependency, frontend, and observability issues. Intercepts deploy commands and blocks until critical items pass. Stack-agnostic. Use for "run ship gate", "am I ready to ship", "pre-launch audit", "can I deploy", "push to production", "go live checklist", "preflight check". Not for CI/CD setup or infra provisioning.
Secrets Management
100Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.
Ci Cd Pipeline Builder
100CI/CD Pipeline Builder
Prompt Guard
100Meta's 86M prompt injection and jailbreak detector. Filters malicious prompts and third-party data for LLM apps. 99%+ TPR, <1% FPR. Fast (<2ms GPU). Multilingual (8 languages). Deploy with HuggingFace or batch processing for RAG security.
Github Workflow Automation
99Advanced GitHub Actions workflow automation with AI swarm coordination, intelligent CI/CD pipelines, and comprehensive repository management
TradeMemory Protocol
100Domänenwissen für die Evolution Engine — LLM-gestützte autonome Strategieentdeckung aus rohen OHLCV-Daten. Behandelt die Schleife Generieren-Backtesten-Auswählen-Entwickeln, vektorisiertes Backtesting, Out-of-Sample-Validierung und Strategiegraduierung. Verwenden Sie es beim Entdecken von Handelspatterns, Ausführen von Backtests, Entwickeln von Strategien oder Überprüfen von Evolutionsprotokollen. Löst aus bei "evolve", "discover patterns", "backtest", "evolution", "strategy generation", "candidate strategy".