GitHub Actions

Check GitHub Actions workflows that run AI agents for injection risks

Trail of Bits' agentic-actions-auditor skill reviews GitHub Actions workflows that call AI coding agents such as Claude Code Action, Codex, Gemini CLI or GitHub's AI Inference action. It finds the steps that start an agent, traces into shared actions and called workflows, and records how each is configured. It then reports places where text an outsider controls, like an issue title, can reach the agent, along with loose sandbox settings and allowlists that accept any user. It only reads workflow files and does not run them.