Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user…
Install
npx skills add trailofbits/skills --skill agentic-actions-auditornpx skills add trailofbits/skills --skill agentic-actions-auditor -a claude-code -gnpx skills add trailofbits/skills --skill agentic-actions-auditor -a codex -ggemini skills install https://github.com/trailofbits/skills.git --path plugins/agentic-actions-auditor/skills/agentic-actions-auditorgh skill install trailofbits/skills agentic-actions-auditorgit clone --depth 1 https://github.com/trailofbits/skills /tmp/trailofbits__skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/trailofbits__skills/plugins/agentic-actions-auditor/skills/agentic-actions-auditor ~/.claude/skills/agentic-actions-auditor # Claude Code
cp -R /tmp/trailofbits__skills/plugins/agentic-actions-auditor/skills/agentic-actions-auditor ~/.agents/skills/agentic-actions-auditor # Codex, Cursor, Gemini CLI, Copilot, OpenCode