# Harden-Runner CI/CD Security Agent for GitHub Actions

> Harden-Runner by StepSecurity is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity in real-time, detecting supply chain attacks such as the tj-actions and Codecov compromises.

- Skill: `agentskillexchange/harden-runner-ci-cd-security-agent-for-github-actions` (Agent Skill)
- Install (CLI): `npx skillmds@latest add agentskillexchange/harden-runner-ci-cd-security-agent-for-github-actions`
- Raw SKILL.md: https://api.skillmd.com/api/skills/agentskillexchange/harden-runner-ci-cd-security-agent-for-github-actions/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: agentskillexchange (https://skillmd.com/u/agentskillexchange)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/agentskillexchange/harden-runner-ci-cd-security-agent-for-github-actions

---


# Harden-Runner CI/CD Security Agent for GitHub Actions

Harden-Runner by StepSecurity is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity in real-time, detecting supply chain attacks such as the tj-actions and Codecov compromises.

## Installation

Requirements and caveats from upstream:
- [Harden-Runner Flagged an Anomalous Outbound Call, Leading to a Docker Documentation Update](https://www.stepsecurity.io/blog/harden-runner-flags-anomalous-outbound-call-leading-to-docker-documentation-update)

Basic usage or getting-started notes:
- [Getting Started Guide](#getting-started)
- This guide walks you through the steps to set up and use Harden-Runner in your CI/CD workflows. For more details, refer to the [official documentation](https://docs.stepsecurity.io/harden-runner).
- ### **Step 1: Add Harden-Runner to Your Workflow**

- Source: https://github.com/step-security/harden-runner
- Extracted from upstream docs: https://raw.githubusercontent.com/step-security/harden-runner/HEAD/README.md

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/harden-runner-cicd-security-agent-github-actions/)