SECURITY REVIEW / Sentry
GitHub Actions Security Review
Reviews GitHub Actions for an external attacker, and withholds a finding that has no entry point, payload and execution path.
“GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. …”
01 / THE REASONING
Why this made the selection.
- The attacker is someone without write access. workflow_dispatch input injection and push-only expression injection on protected branches are out of scope.
- A high finding needs an entry point, payload, execution mechanism, impact and a proof sketch. The file says to report zero findings rather than invent issues.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- skills/gha-security-review/SKILL.md
- README.md skills package section
- LICENSE
- README.md
- vercel-labs/skills@48dc9e8eb8aa19040e91cb90ba0b642c9cbad57e:README.md
Our findings
- The safe-pattern table in the primary file says ${{ }} inside run: is the injection sink, and it says not to flag first-party actions/* tags as third-party pinning gaps.
- Confidence below a traced path is not reported. The named reference files were not all read.
- The definition requires entry point, payload, execution mechanism, impact and a reproduction sketch for high-confidence findings; partial paths remain needs-verification.
- The files-to-review section includes action.yml/action.yaml, local reusable actions, and workflow-loaded configuration such as CLAUDE.md, AGENTS.md, Makefile, and shell scripts.
Not established by this review
- No workflow was executed. The StepSecurity post cited in an HTML comment was not opened.
- Not executed: it was not installed or run.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
npx skills add getsentry/skills/skills/gha-security-reviewRun in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above.
Optional: install the reviewed revision
Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose.
npx skills add https://github.com/getsentry/skills/tree/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/gha-security-review- The README command installs the whole Sentry skills repository.
- The command here pins only gha-security-review at the reviewed commit. The installer was not executed.
Before you start
- Node.js and npm
- Workflow files to review
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/gha-security-review/SKILL.md
Supports: summary, upstreamDescription, whySelected, limitations
- Publisher README ↗Checked
https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/README.md
Supports: install, compatibility
- Apache-2.0 licence ↗Checked
https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/LICENSE
Supports: license
https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/src/source-parser.ts
Supports: install
https://raw.githubusercontent.com/getsentry/skills/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/gha-security-review/SKILL.md
Supports: review.findings, bestFor, limitations