Copilot GitHub Actions Hardening
SkillReview your workflow YAML for script injection, risky pull_request_target use, unpinned actions and over-scoped tokens.
by github Listed Jun 11, 2025
Clone or download it from github.com, then drop the folder into ~/.claude/skills/ (Claude Code) or your agent's skills directory.
Product badge
Share this product's name and rating in your README or on your website.
Updates may be delayed by image caching.
About Copilot GitHub Actions Hardening
From GitHub's awesome-copilot repo. It teaches your agent the Actions-specific risks that general linters miss, so it can lock down your own CI: pin actions, trim GITHUB_TOKEN permissions, and keep untrusted input out of run steps.
A defensive review skill for your own workflows, useful whenever an agent writes or edits files under .github/workflows.
No reviews yet
Used it? Write the first review.