Trail of Bits' agentic-actions-auditor skill reviews GitHub Actions workflows that call AI coding agents such as Claude Code Action, Codex, Gemini CLI or GitHub's AI Inference action. It finds the steps that start an agent, traces into shared actions and called workflows, and records how each is configured. It then reports places where text an outsider controls, like an issue title, can reach the agent, along with loose sandbox settings and allowlists that accept any user. It only reads workflow files and does not run them.
Audit Firebase security rulesThis skill reviews the security rules for Firestore and Cloud Storage, looking for weak spots, red-team style. Its checklist covers privilege escalation, role bypasses, mismatched create and update logic, resource exhaustion, type checks, and size limits. Each rule set gets a score from 1 to 5.Coding agentFirebaseSecurity
Azure ComplianceRuns Azure compliance and security audits with azqr and checks Key Vault secret expiration.Coding agentSecurityInfra
Cloudflare OneDesigns and troubleshoots Cloudflare One Zero Trust and SASE deployments.Coding agentSecurityInfra
CodeQLRuns CodeQL static analysis with interprocedural dataflow and taint tracking across major languages.Coding agentSecurityTesting
Git Guardrails for Claude CodeAdds Claude Code hooks that block dangerous Git commands before execution.Coding agentSecurityGit
Mutation TestingConfigures mutation-testing campaigns and investigates surviving mutants for test gaps.Coding agentTestingSecurity
