此内容尚未提供您的语言版本,正在以英文显示。

Agentic Actions Auditor

插件活跃

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations (Claude Code Action, Gemini CLI, OpenAI Codex, GitHub AI Inference)

1 个 Skill 0 个 MCP

目的

To help security auditors and developers identify and remediate security risks in GitHub Actions workflows that integrate AI agents, ensuring secure CI/CD pipelines.

功能

Audits GitHub Actions workflows for AI agent security vulnerabilities
Detects specific attack vectors like env var intermediary, direct expression injection, and wildcard allowlists
Supports multiple AI agent integrations (Claude Code, Gemini CLI, OpenAI Codex, GitHub AI Inference)
Provides detailed findings with impact, evidence, data flow, and remediation guidance

使用场景

Auditing CI/CD pipelines that use AI agents for security risks
Reviewing GitHub Actions workflow configurations for prompt injection vulnerabilities
Ensuring secure defaults for AI-assisted code review and agentic actions
Assessing the security impact of attacker-controlled input on AI agents running in CI

非目标

Performing runtime prompt injection testing or exploitation
Auto-fixing or modifying workflow files
Auditing non-GitHub CI/CD systems
Analyzing workflows that do not use AI agent actions

Trust

warning:Issues AttentionThere are 13 open issues and 4 closed issues in the last 90 days, indicating slow issue closure and potential maintainer bottleneck.

安装

请先添加 Marketplace

/plugin marketplace add trailofbits/skills

/plugin install agentic-actions-auditor@trailofbits

包含 1 个扩展

Skill (1)

Agentic Actions Auditor 技能

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.

质量评分

75 /100

about 12 hours ago 分析

信任信号

最近提交3 days ago

GitHub 所有者 trailofbits

星标5.2k

许可证CC-BY-SA-4.0

状态

查看源代码

类似扩展

Agent Almanac

350 agentic skills across 64 domains, 72 agent personas, and 16 team compositions following the agentskills.io open standard

插件

pjt222

Ruflo Security Audit

Security review, dependency scanning, policy gates, and CVE monitoring

插件

ruvnet

Shell Scripting Plugins

Production-grade Bash scripting with defensive programming, POSIX compliance, and comprehensive testing

插件

wshobson

Review Agent Governance

Require a human approval signal before an AI agent can post PR reviews, comments, merges, or writes to CI config. Cedar-gated, receipt-signed, designed for the Hermes-style failure mode where a review bot posts without oversight.

插件

wshobson

Performance Testing Review

Performance analysis, test coverage review, and AI-powered code quality assessment

插件

wshobson

Comprehensive Review

Multi-perspective code analysis covering architecture, security, and best practices

插件

wshobson