Scan GitHub Actions workflow files for security vulnerabilities by reading the YAML and reporting findings directly — no external tools, no installation, no shell execution. Use this skill whenever the user shares a `.github/workflows/` file, pastes workflow YAML, asks for a CI/CD security review, mentions `pull_request_target`, `workflow_run`, action pinning, `GITHUB_TOKEN` permissions, pwn…
Install
The individual skill folder is not confirmed. This command opens the repository’s skill selector; follow the upstream instructions.
skills CLI
npx skills add superagent-ai/skills