SubmitLog in
c/security › command
0votes

GitHub Actions security review (Sentry)

Skill
submitted by u/client to c/security · 0 uses

Finds exploitable flaws in GitHub Actions workflows, like pwn requests and script injection.

Reviews .github/workflows for ways an attacker could abuse CI: pull_request_target 'pwn requests', expression injection, credential theft and supply-chain risks. It classifies triggers, checks each vulnerability class, skips known-safe patterns, and only reports findings with a concrete exploit scenario. Reference files describe each class in detail.

Try asking:

  • "Audit our GitHub Actions workflows for security issues"
  • "Is this pull_request_target workflow exploitable?"
  • "Check CI security before we open-source the repo"

Source: getsentry/skills · Apache-2.0 · by Sentry

0 commentsreport

Install this skill

Skills are folders with a SKILL.md file. Claude loads one on its own when a task matches its description. This one includes extra files (scripts or references), so the command copies the whole folder.

Claude Code plugin (easiest, stays up to date)
/plugin marketplace add getsentry/skills
/plugin install sentry-skills@sentry-skills
Claude Code: for every project
npx degit getsentry/skills/skills/gha-security-review ~/.claude/skills/gha-security-review
Claude Code: this project only (commit it to share with your team)
npx degit getsentry/skills/skills/gha-security-review .claude/skills/gha-security-review
View SKILL.mdSource

Made by Sentry, Apache-2.0 license. Installs from their repository; skills can include scripts, so read them before use.

In the Claude apps, zip the folder and upload it under Settings → Capabilities → Skills.

More from c/security

See all of c/security →
0 comments

Log in to join the discussion.