Claude Skill

Audit GitHub Actions workflows for insecure permissions and unpinned actions

This ASE skill uses zizmor to audit GitHub Actions workflows and composite actions for security mistakes before they ship. An agent can scan local repos or remote GitHub repositories, flag risky permission scopes and unsafe workflow patterns, and return plain output, GitHub-nativ

LLM Mart · 0 points · 0 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download agentskillexchange-skills-skills_audit-github-actions-workflows-for-insecure-permissions-and-unpinned-actions-07beb56.zip · 0 KB

agentskillexchange/skills 45 57 forks MIT Updated 3d ago

Part of agentskillexchange/skills — 249 skills

Install

skills CLI

npx skills add https://github.com/agentskillexchange/skills/tree/main/skills/audit-github-actions-workflows-for-insecure-permissions-and-unpinned-actions

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install agentskillexchange-skills@llmmart

Git git clone https://github.com/agentskillexchange/skills.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole agentskillexchange/skills collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

Audit GitHub Actions workflows for insecure permissions and unpinned actions

Prerequisites

GitHub Actions workflow files or a GitHub repository, with a GitHub token only when auditing remote or private repos

Installation

Basic usage or getting-started notes:

detailed usage recipes.
Source: https://github.com/zizmorcore/zizmor
Extracted from upstream docs: https://raw.githubusercontent.com/zizmorcore/zizmor/HEAD/README.md

Documentation

https://docs.zizmor.sh/

Source

Agent Skill Exchange

Files (skills)

SKILL.md 1.8 KB

---
name: "Audit GitHub Actions workflows for insecure permissions and unpinned actions"
slug: "audit-github-actions-workflows-for-insecure-permissions-and-unpinned-actions"
description: "This ASE skill uses zizmor to audit GitHub Actions workflows and composite actions for security mistakes before they ship. An agent can scan local repos or remote GitHub repositories, flag risky permission scopes and unsafe workflow patterns, and return plain output, GitHub-native findings, or SARIF for follow-up automation."
github_stars: 4145
verification: "security_reviewed"
source: "https://github.com/zizmorcore/zizmor"
author: "zizmorcore"
publisher_type: "Open Source Project"
category: "Security & Verification"
framework: "Multi-Framework"
tool_ecosystem:
  github_repo: "zizmorcore/zizmor"
  github_stars: 4145
---

# Audit GitHub Actions workflows for insecure permissions and unpinned actions

This ASE skill uses zizmor to audit GitHub Actions workflows and composite actions for security mistakes before they ship. An agent can scan local repos or remote GitHub repositories, flag risky permission scopes and unsafe workflow patterns, and return plain output, GitHub-native findings, or SARIF for follow-up automation.

## Prerequisites

GitHub Actions workflow files or a GitHub repository, with a GitHub token only when auditing remote or private repos

## Installation

Basic usage or getting-started notes:
- [detailed usage recipes].
- [detailed usage recipes]: https://docs.zizmor.sh/usage/

- Source: https://github.com/zizmorcore/zizmor
- Extracted from upstream docs: https://raw.githubusercontent.com/zizmorcore/zizmor/HEAD/README.md

## Documentation

- https://docs.zizmor.sh/

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/audit-github-actions-workflows-for-insecure-permissions-and-unpinned-actions/)