How do I install the Github Actions Security Hardening skill?

Run npx skillmds@latest add aibot88/github-actions-security-hardening in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Github Actions Security Hardening safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Github Actions Security Hardening?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Github Actions Security Hardening free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Github Actions Security Hardening?

aibot88 (@aibot88) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Github Actions Security Hardening by aibot88

Name: Github Actions Security Hardening
Rating: 4.2 (5 reviews)
Author: aibot88

File contents

GitHub Actions Security Hardening

Purpose

Reduce CI/CD and workflow supply-chain risk while preserving delivery velocity.

Core controls

GITHUB_TOKEN least privilege (default read, elevate per-job only when required).
Third-party actions pinned to full commit SHA where policy requires.
Secrets hygiene (least privilege, rotation, masking, no plaintext leakage).
OIDC preferred over long-lived cloud credentials.
CODEOWNERS coverage for .github/workflows/.
Dependency and vulnerability monitoring for Actions dependencies.
Runner strategy hardening (hosted preferred for untrusted PRs; strict controls for self-hosted).
Optional: block or limit Actions ability to create/approve PRs where policy requires.

Hard constraints

No auto-remediation that broadens permissions.
No direct write changes to production deployment workflows without explicit approval trail.
If workflow trust boundaries are unclear, return NO_CHANGE.

Output contract

ACTIONS_SECURITY_REPORT
mode: <audit|plan|remediate|verify>
scope: <repo|org>
runner: <hosted|self-hosted|mixed>
policy_profile: <strict|standard|light>

checks:
- id: A1
  control: <token-permissions|pinning|oidc|...>
  result: <pass|fail|partial>
  evidence: <file/setting/observation>
  risk: <low|medium|high>

actions:
1) priority: <P1|P2|P3>
   change: <specific remediation>
   verification: <objective check>

decision:
- <apply|defer|NO_CHANGE>

missing_evidence:
- <none or required artifacts>

Invocation policy

Run in pre-merge for workflow/security-sensitive changes and in periodic governance audits.

Repo workflow inventory

Workflow	Trigger	Permissions	Status
`.github/workflows/lint.yml`	PR/push to main	default read	✅ active
`.github/workflows/label-lint.yml`	issues events	`issues:write`, `contents:read`	✅ active (ADR-010)

label-lint.yml enforces ADR-010 rules 1–4 on every issue event. Any violation posts an explanatory comment and fails the check. See research/adr/010-ticket-status-role-model.md.

---name: github-actions-security-hardeningdescription: Enforce secure GitHub Actions posture with least-privilege tokens, pinned dependencies, runner risk controls, and workflow supply-chain checks.--- # GitHub Actions Security Hardening ## Purpose Reduce CI/CD and workflow supply-chain risk while preserving delivery velocity. ## Core controls 1. `GITHUB_TOKEN` least privilege (default read, elevate per-job only when required). 2. Third-party actions pinned to full commit SHA where policy requires. 3. Secrets hygiene (least privilege, rotation, masking, no plaintext leakage). 4. OIDC preferred over long-lived cloud credentials. 5. CODEOWNERS coverage for `.github/workflows/`. 6. Dependency and vulnerability monitoring for Actions dependencies. 7. Runner strategy hardening (hosted preferred for untrusted PRs; strict controls for self-hosted). 8. Optional: block or limit Actions ability to create/approve PRs where policy requires. ## Hard constraints - No auto-remediation that broadens permissions. - No direct write changes to production deployment workflows without explicit approval trail. - If workflow trust boundaries are unclear, return `NO_CHANGE`. ## Output contract ```text ACTIONS_SECURITY_REPORT mode: <audit|plan|remediate|verify> scope: <repo|org> runner: <hosted|self-hosted|mixed> policy_profile: <strict|standard|light> checks: - id: A1 control: <token-permissions|pinning|oidc|...> result: <pass|fail|partial> evidence: <file/setting/observation> risk: <low|medium|high> actions: 1) priority: <P1|P2|P3> change: <specific remediation> verification: <objective check> decision: - <apply|defer|NO_CHANGE> missing_evidence: - <none or required artifacts> ``` ## Invocation policy Run in pre-merge for workflow/security-sensitive changes and in periodic governance audits. ## Repo workflow inventory | Workflow | Trigger | Permissions | Status | |---|---|---|---| | `.github/workflows/lint.yml` | PR/push to main | default read | ✅ active | | `.github/workflows/label-lint.yml` | issues events | `issues:write`, `contents:read` | ✅ active (ADR-010) | `label-lint.yml` enforces ADR-010 rules 1–4 on every issue event. Any violation posts an explanatory comment and fails the check. See `research/adr/010-ticket-status-role-model.md`.

Frequently asked questions

Github Actions Security Hardening