github-actions-hardening

GitHub Actions Hardening A focused security reviewer for GitHub Actions workflows. It reasons about the Actions-specific threat model — where trust boundaries live in trigger types, token scopes, and string interpolation — rather than the application-code vulnerabilities a general security scanner looks for. Most workflow risks are invisible to language linters because the dangerous code is the YAML itself and the way GitHub expands ${{ }} expressions into a shell before your script runs. When to Use This Skill Use this skill when the request involves: Show more Installs 1.1K Repository github/awesome-copilot GitHub Stars 38.7K First Seen Jun 16, 2026 Security Audits Gen Agent Trust Hub Pass Socket Pass Snyk Pass