Claude Code
Codex
Cursor
GitHub Copilot
Gemini CLIAbout this skill
Audits GitHub Actions CI/CD workflow files for supply chain and pipeline security risks. Use when asked to audit, analyze, scan, or review GitHub Actions workflows, .github/workflows/, CI/CD pipelines, pipeline security, or DevSecOps pipeline hardening. Detects unpinned third-party actions (supply chain attacks like tj-actions CVE-2025-30066), expression injection / script injection, overly permissive permissions, dangerous triggers (pullrequesttarget, workflowrun PPE), secrets exposure, and self-hosted runner risks. Part of the GRIMSEC DevSecOps agent suite.
Quick start
- Copy the install prompt. Use the green button above this README.
- Send it to your agent. Paste it into your coding agent’s chat and send.
- Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.
Review, license & listing details
This is an imported listing. We haven’t certified its safety, license, or compatibility. Skills may include executable scripts.
Only SKILL.md was scanned. Supporting files and scripts were not checked. No safety grade has been assigned.
0 potential findings · Scanned 11/4/2026 · Scanner 0.2.1
Content SHA-256: 20a0e3cc54247c6ee588e9383af472bbde2929c67863666e384c968098cbde5a
About this listing
- Category
- Engineering
- Reported license
- MIT
- Listing language (estimated)
- English
- Review status
- Not individually reviewed
- Agent compatibility
- Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.