workflow-security-audit
Conducts security audits on GitHub workflows to identify vulnerabilities and apply auto-fixes, enhancing repository security.
Install this skill
Security score
The workflow-security-audit skill was audited on May 30, 2026 and we found 14 security issues across 1 threat category, including 9 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 21 | **A. Script injection** — `${{ ... }}` expressions used directly inside `run:` blocks that may contain user-controlled content: |
Template literal with variable interpolation in command context
| 22 | - `${{ inputs.* }}` inside `run:` without an env-var intermediary |
Template literal with variable interpolation in command context
| 23 | - `${{ github.event.* }}` inside `run:` (especially `client_payload.*`, `issue.title`, `issue.body`, `head_commit.message`, `pull_request.title`, `pull_request.body`) |
Template literal with variable interpolation in command context
| 24 | - `${{ steps.*.outputs.* }}` inside `run:` where the output originated from user-controlled data |
Template literal with variable interpolation in command context
| 26 | The safe pattern is always: declare `env: MY_VAR: ${{ ... }}` on the step, then use `"$MY_VAR"` in the shell. Direct interpolation lets shell metacharacters (backticks, `$()`, `"`) in the value execut |
Template literal with variable interpolation in command context
| 32 | **D. Secret exposure** — `echo "${{ secrets.* }}"` or similar patterns that print secrets to logs or include them in commit messages. |
Template literal with variable interpolation in command context
| 34 | **E. Fleet-specific risks** — `spawn-instance` or `fleet-control` jobs that pass `${{ inputs.* }}` directly into shell commands responsible for dispatching child runs. |
Template literal with variable interpolation in command context
| 50 | ```yaml |
Template literal with variable interpolation in command context
| 68 | Write findings to `articles/workflow-security-audit-${today}.md`: |
Template literal with variable interpolation in command context
| 70 | ```markdown |
Template literal with variable interpolation in command context
| 82 | **Pattern:** `${{ inputs.message }}` |
Template literal with variable interpolation in command context
| 100 | ```bash |
Template literal with variable interpolation in command context
| 119 | Append to `memory/logs/${today}.md`: |
Template literal with variable interpolation in command context
| 120 | ``` |