--- title: "GitHub Actions Security Review: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/getsentry-gha-security-review/ description: "Reviews GitHub Actions for an external attacker, and withholds a finding that has no entry point, payload and execution path." --- # GitHub Actions Security Review: review, setup & limitations · Undominated.ai > Reviews GitHub Actions for an external attacker, and withholds a finding that has no entry point, payload and execution path. [← Explore all skills](/skills/) SECURITY REVIEW / Sentry # GitHub Actions Security Review Reviews GitHub Actions for an external attacker, and withholds a finding that has no entry point, payload and execution path. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/getsentry/skills/tree/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/gha-security-review) SOURCE REVIEW Reviewed 2026-10-15 Evidence 5 linked sources Publisher Sentry Licence [Apache-2.0 ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/LICENSE) Revision d18b7aa8ba87 [Read what was—and wasn’t—checked ↓](#review) “GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. …” [Sentry · upstream description ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/gha-security-review/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The attacker is someone without write access. workflow_dispatch input injection and push-only expression injection on protected branches are out of scope. - A high finding needs an entry point, payload, execution mechanism, impact and a proof sketch. The file says to report zero findings rather than invent issues. ### A good fit for - Reviewing .github/workflows for fork pull requests and expression injection - Deciding whether a workflow permission is reachable by an outside contributor - Trace an external contributor payload through triggers, checkout and credential use - Include local composite actions and workflow-loaded instruction or build files in the workflow review scope. ### Weigh up before choosing - The file treats ${{ }} in if:, with: and job or step env: as runtime evaluation rather than a shell sink. A later unquoted use of that variable can still be ordinary shell injection. - Allowed tools include Bash and Task. The whole-pack install includes skills this catalogue has withheld. - This review intentionally excludes threats requiring repository write access. It is not a complete insider or compromised-maintainer assessment. - Workflows in other repositories and GitHub App installation permissions are outside the stated review scope; dependencies and relevant installation permissions are only noted. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - skills/gha-security-review/SKILL.md - README.md skills package section - LICENSE - README.md - vercel-labs/skills@48dc9e8eb8aa19040e91cb90ba0b642c9cbad57e:README.md ### Our findings - The safe-pattern table in the primary file says ${{ }} inside run: is the injection sink, and it says not to flag first-party actions/* tags as third-party pinning gaps. - Confidence below a traced path is not reported. The named reference files were not all read. - The definition requires entry point, payload, execution mechanism, impact and a reproduction sketch for high-confidence findings; partial paths remain needs-verification. - The files-to-review section includes action.yml/action.yaml, local reusable actions, and workflow-loaded configuration such as CLAUDE.md, AGENTS.md, Makefile, and shell scripts. ### Not established by this review - No workflow was executed. The StepSecurity post cited in an HTML comment was not opened. - Not executed: it was not installed or run. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/vercel-labs/skills/blob/48dc9e8eb8aa19040e91cb90ba0b642c9cbad57e/README.md) DOCUMENTED COMMAND npx skills add getsentry/skills/skills/gha-security-review Copy command ↗ Run in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above. Optional: install the reviewed revision Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose. npx skills add https://github.com/getsentry/skills/tree/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/gha-security-review Copy reviewed-revision command ↗ - The README command installs the whole Sentry skills repository. - The command here pins only gha-security-review at the reviewed commit. The installer was not executed. ### Before you start - Node.js and npm - Workflow files to review ### Compatibility Claude Code · Cursor · Cline · GitHub Copilot ### Repository workflow review; Bash is allowed by the frontmatter - Read workflow YAML and local actions - The frontmatter also allows Bash and Task - Read workflows, reusable actions and repository permissions; optional local investigation commands do not themselves authorize triggering privileged CI. ### Cost model Apache-2.0 instructions at no charge. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Skill definition at reviewed revision ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/gha-security-review/SKILL.md) Checked 2026-10-14 https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/gha-security-review/SKILL.md Supports: summary, upstreamDescription, whySelected, limitations - [Publisher README ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/README.md) Checked 2026-10-07 https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/README.md Supports: install, compatibility - [Apache-2.0 licence ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/LICENSE) Checked 2026-10-07 https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/LICENSE Supports: license - [Skills installer tree URL parsing ↗](https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/src/source-parser.ts) Checked 2026-10-07 https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/src/source-parser.ts Supports: install - [Pinned definition review, 2026-10-15 ↗](https://raw.githubusercontent.com/getsentry/skills/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/gha-security-review/SKILL.md) Checked 2026-10-15 https://raw.githubusercontent.com/getsentry/skills/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/gha-security-review/SKILL.md Supports: review.findings, bestFor, limitations KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Skill scanner ↗ Audits a skill before install, with a bundled script and explicit confidence levels.](/skills/getsentry-skill-scanner/)[### Algorand vulnerability scanner ↗ Pins Trail of Bits' Algorand scanner, which treats a short or empty coverage table as an unfinished scan and does not let a clean Tealer run stand in for patterns it never examined.](/skills/trailofbits-algorand-vulnerability-scanner/)[### CodeQL ↗ Drives a CodeQL scan and warns that each Bash call is a fresh shell, so state must be written to files.](/skills/trailofbits-codeql/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)