Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and over-scoped tokens.
Install
npx skills add github/awesome-copilot --skill github-actions-hardeningnpx skills add github/awesome-copilot --skill github-actions-hardening -a claude-code -gnpx skills add github/awesome-copilot --skill github-actions-hardening -a codex -ggemini skills install https://github.com/github/awesome-copilot.git --path skills/github-actions-hardeninggh skill install github/awesome-copilot github-actions-hardeninggit clone --depth 1 https://github.com/github/awesome-copilot /tmp/github__awesome-copilot
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/github__awesome-copilot/skills/github-actions-hardening ~/.claude/skills/github-actions-hardening # Claude Code
cp -R /tmp/github__awesome-copilot/skills/github-actions-hardening ~/.agents/skills/github-actions-hardening # Codex, Cursor, Gemini CLI, Copilot, OpenCode