SecurityApache-2.0

GitHub Actions security review

by Sentry (opens in a new tab) getsentry/skills

Traces exploitable GitHub Actions workflow paths instead of flagging generic CI patterns.

Installation

Skills CLI

Skills CLI command
npx skills@latest add getsentry/skills --skill gha-security-review

Requires Node.js and npm. Choose your agents in the installer; add -g for a global installation.

Fieldbook review

Reviewed 27 Sept 2026

Limits findings to externally exploitable paths and requires a concrete attack scenario. It loads focused references for the workflow triggers it finds.

  • LicenceApache-2.0
  • FrontmatterValid name and description
  • Risky patternsNone found
  • Size193 lines
  • Last checked27 Sept 2026 · 2820545333988c4834fe6ac4e05d3efafc02bd0e4097e0f28f4ebfc48e116a3d

What it can touch

  • Runs commands

    Runs shell commands such as tests, builds or installs.

  • Subagents

    Starts other agents to work in parallel.

Read the source

Fieldbook links to the original instead of copying it, so you always read the version you install.

skills/gha-security-review/SKILL.md on GitHub (opens in a new tab)