claude-actions-auditor

Iron Law

NO FINDINGS REPORT WITHOUT READING EVERY WORKFLOW FILE — never report "clean" based on filename or trigger alone; the env var intermediary (Vector A) is invisible without tracing data flow through the full YAML

Claude Actions Auditor

Static security analysis for GitHub Actions workflows that invoke anthropics/claude-code-action. Discovers workflow files, identifies Claude Code Action steps, captures security-relevant configuration, and detects 9 attack vectors where attacker-controlled input reaches Claude running in CI/CD.

When to Use

• Auditing a repository's GitHub Actions workflows that use anthropics/claude-code-action
• Before adding Claude Code Action to any workflow
• Reviewing whether attacker-controlled GitHub event data can reach Claude's prompt
• Evaluating Claude Code Action configuration (sandbox settings, tool permissions, user allowlists)
• Assessing trigger events that expose workflows to external input (pull_request_target, issue_comment, etc.)
• Investigating data flow from GitHub event context through env: blocks to Claude's prompt field

When NOT to Use

• Analyzing workflows that do NOT use anthropics/claude-code-action
• Performing runtime prompt injection testing (this is static analysis only, not exploitation)
• Auditing non-GitHub CI/CD systems (Jenkins, GitLab CI, CircleCI)
• Auto-fixing or modifying workflow files (this skill reports findings, does not modify files)

Rationalizations to Reject

When auditing Claude Code Action workflows, reject these common rationalizations. Each represents a reasoning shortcut that leads to missed findings.

1. "It only runs on PRs from maintainers" Wrong because it ignores pull_request_target, issue_comment, and other trigger events that expose actions to external input. Attackers do not need write access to trigger these workflows. A pull_request_target event runs in the context of the base branch, not the PR branch, meaning any external contributor can trigger it by opening a PR.