Agent skill · GitHub (community contributions)
GitHub Actions Hardening skill for Claude Code, Codex and Cursor
Communityname: github-actions-hardening★ 40k (repo)pushed 2026-10-23MITSKILL.md on GitHubchecked 2026-11-07
What it does, in the publisher's words
Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and over-scoped tokens.
The description field of the SKILL.md. The agent reads only this at startup and decides from it when to load the full skill.
Install GitHub Actions Hardening
The skills CLI copies the skill into the folder of each agent you pick (Claude Code, Codex, Cursor, Copilot, Gemini CLI, OpenCode, Windsurf...). Add -g for all projects. Needs Node.js 22.20+. docs
npx skills add github/awesome-copilot --skill github-actions-hardening
Copy the skill folder into ~/.claude/skills (all projects) or .claude/skills (this repo). Claude Code picks it up without a restart. docs
npx skills add github/awesome-copilot --skill github-actions-hardening -a claude-code # or by hand: git clone --depth 1 https://github.com/github/awesome-copilot.git /tmp/github-actions-hardening-src cp -r /tmp/github-actions-hardening-src/skills/github-actions-hardening ~/.claude/skills/github-actions-hardening
Download the skill folder, zip it, then Customize > Skills > + > Create skill > Upload a skill. Code execution must be on (Settings > Capabilities). docs
git clone --depth 1 https://github.com/github/awesome-copilot.git /tmp/github-actions-hardening-src cp -r /tmp/github-actions-hardening-src/skills/github-actions-hardening ./github-actions-hardening zip -r github-actions-hardening.zip github-actions-hardening
Codex reads skills from .agents/skills in the repo or ~/.agents/skills. Type $ in Codex to use one. docs
npx skills add github/awesome-copilot --skill github-actions-hardening -a codex
gh skill (GitHub CLI 2.90+, preview) installs it for Copilot in VS Code, the CLI and the cloud agent. Copilot also reads .github/skills and ~/.copilot/skills. docs
gh skill install github/awesome-copilot github-actions-hardening
Cursor reads .cursor/skills, .agents/skills and ~/.cursor/skills (and .claude/skills). It does not install loose skills from a GitHub URL, so copy it in. docs
npx skills add github/awesome-copilot --skill github-actions-hardening -a cursor
Installs from the GitHub repo; --path picks this skill out of the repo. Default scope is user (all projects). docs
gemini skills install https://github.com/github/awesome-copilot.git --path skills/github-actions-hardening
OpenCode reads .opencode/skills, ~/.config/opencode/skills and the Claude and .agents folders. docs
npx skills add github/awesome-copilot --skill github-actions-hardening -a opencode
Windsurf (now Devin Desktop) reads .devin/skills, .windsurf/skills and ~/.codeium/windsurf/skills. docs
npx skills add github/awesome-copilot --skill github-actions-hardening -a windsurf
Works with
Claude Code, Claude.ai and Claude Desktop, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and other agents that read the open Agent Skills format.
What's in the SKILL.md
- When to Use This Skill
- The Core Insight
- Execution Workflow
- Step 1 — Map the Triggers and Trust Level
- Step 2 — Hunt for Script Injection
- Step 3 — Check Privileged Triggers Don't Execute Untrusted Code
- Step 4 — Audit permissions:
- Step 5 — Audit Action References (Supply Chain)
- Step 6 — Check Secret and Output Handling
- Step 7 — Produce the Report
- Severity Guide
- Output Rules
- Reference Files
Bundled files
- references/injection.md
- references/permissions-and-tokens.md
- references/report-format.md
- references/supply-chain.md
- references/triggers-and-privilege.md
Loaded only when the instructions point to them.
Facts
- Skill name
- github-actions-hardening
- Publisher
- GitHub (community contributions) (community)
- Repo
- github/awesome-copilot
- License
- MIT
- SKILL.md size
- 1,241 words, 156 lines
- Bundled files
- 5, 5 docs
- Repo stars
- 40k (as of 2026-10-24)
- SKILL.md checked
- 2026-11-07
Pairs with the GitHub Actions MCP server: the server gives the agent the tools, the skill teaches it how to use them.
More skills from github/awesome-copilot
- Git Commit: Reads the diff, stages related files and writes conventional commits, splitting when needed.
Related security & auth skills
- Security Best Practices Review · OpenAI
- Security Threat Model · OpenAI
- Sign In With Google (Web) · Google
- Agentic Actions Auditor · Trail of Bits
- CodeQL Scan · Trail of Bits
- Constant-Time Analysis · Trail of Bits
- Differential Security Review · Trail of Bits
- Semgrep Rule Creator · Trail of Bits
FAQ
What does the github-actions-hardening skill do?+
Reviews workflow files for script injection, risky triggers and over-broad permissions. In its own SKILL.md, GitHub (community contributions) describes it as: "Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and over-scoped..."
How do I install the github-actions-hardening skill?+
Run npx skills add github/awesome-copilot --skill github-actions-hardening and pick your agents, or use the tab for your agent above. In Claude Code the skill ends up in ~/.claude/skills/github-actions-hardening/SKILL.md; in Codex and Cursor in .agents/skills/github-actions-hardening/.
Does GitHub Actions Hardening work in Codex, Cursor and Copilot, or only Claude?+
It's a standard SKILL.md, so any agent that reads the Agent Skills format can use it: Claude Code, the Claude apps, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and more.
Who maintains GitHub Actions Hardening?+
GitHub (community contributions) (a community project), in the github/awesome-copilot repo on GitHub, last pushed 2026-10-23. License: MIT.
Read a skill's SKILL.md and scripts before you install it: skills aren't verified by any agent vendor. Claude skills marketplace · How to install skills · MCP servers