Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add s977043/river-review --skill gha-workflow-securitygit clone --depth 1 https://github.com/s977043/river-reviewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/s977043/river-review/gha-workflow-security)<a href="https://agentmods.dev/skills/s977043/river-review/gha-workflow-security"><img src="https://agentmods.dev/badge/skills/s977043/river-review/gha-workflow-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/s977043/river-review/gha-workflow-security"><img src="https://agentmods.dev/badge/skills/s977043/river-review/gha-workflow-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.01166 |
| Opus 5 | $0.00023 | $0.00583 |
| Sonnet 5 | $0.00009 | $0.00233 |
| Haiku 4.5 | $0.00005 | $0.00117 |
Grade A, and why
GitHub Actions Workflow Security Review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pattern declaration
Primary pattern: Reviewer Secondary patterns: Inversion Why: workflow の意味的なセキュリティ判断（権限の必要性・トリガーの用途）に集中し、決定論ツールが見ない文脈を検査する
Goal / 目的
- untrusted input の式展開によるスクリプトインジェクションと、特権トリガー + untrusted checkout（pwn request）を検出する。
- GITHUB_TOKEN の過剰権限と third-party action の未ピン留めを検出する。
Non-goals / 扱わないこと
- 構文的に決定論で判定できる領域（pinned-dependencies / token-permissions の機械検出）は OpenSSF Scorecard / zizmor / CodeQL に委ねる（重複指摘しない）。
- workflow のロジック・効率（セキュリティ以外）。
Pre-execution Gate / 実行前ゲート
このスキルは以下の条件がすべて満たされない限りNO_REVIEWを返す。
- 差分に
.github/workflows/配下の追加変更が含まれている - diff コンテキストが利用可能である
ゲート不成立時の出力: NO_REVIEW: gha-workflow-security — workflow の変更なし
False-positive guards / 抑制条件
- 同一 repo / 自 org 内 action（
./.github/actions/...、自 org reusable workflow）はピン留め不要とする運用が一般的。minor 以下に留める。 actions/*公式 action の tag 運用は third-party より低リスク。minor 扱い。if:条件式内の式展開、github.event.*.number/github.sha/github.actor等の数値・制約付きフィールドは原則安全。- checkout なし、または base ref checkout のみの
pull_request_targetは安全パターン。 - repo 可視性が不明な self-hosted runner は major でなく warning + 確認依頼にする。
Rule / ルール
- 攻撃者制御フィールド（
github.event.issue.title/.body、pull_request.title/.body/.head.ref、comment.body、commits.*.message、github.head_ref等）をrun:に直接式展開しない。env:経由で変数化する。 pull_request_target/issue_comment/workflow_runでhead.sha/head.refを checkout して PR 由来コードを実行しない（secrets + write 権限の文脈での RCE）。permissionsは top-level をcontents: readにし、write は必要な job 単位で昇格する（write-allを避ける）。- third-party action は full-length commit SHA でピン留めする（バージョンコメント併記を推奨）。
Evidence / 根拠の取り方
- 指摘は
<file>:<line>で差分に紐づけ、出典（securitylab.github.com / docs.github.com の secure-use）を 1 行で添える。 - 重要度: untrusted input の
run:直挿し /pull_request_target+ head checkout = critical、permissions 過剰 / public self-hosted = major、tag ピン / persist-credentials = minor。
Output / 出力（短文版の推奨）
コメントは日本語で返す。
- Finding: インジェクション / pwn request / 過剰権限 / 未ピンのどれか（1文）
- Impact: RCE / secrets 漏えい / 権限昇格
- Fix: env 経由 / トリガー分離 / job 単位 permissions / SHA ピンの最小案
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 76 lines · 46 tokens per session scan A efc5bd53795c
GitHub Actions Workflow Security Review is a skill published in the GitHub repository s977043/river-review (3 stars, last pushed today), licensed MIT. It adds 46 tokens to every session and 1,166 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
watch-pr
Watch a GitHub pull request for CI status, reviews, comments, merge conflicts, and terminal states using the gh-watch extension. Use when the user wants to monitor a PR, wait for CI, or track PR progress.
watch-commit
Watch a GitHub commit for CI status changes using the gh-watch extension. Use when the user wants to monitor a commit's CI checks, wait for a build to finish, or track CI progress on a specific SHA.
securing-github-actions-workflows
This skill covers hardening GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation. It addresses pinning actions to SHA digests, minimizing GITHUBTOKEN permissions, protecting secrets from exfiltration, preventing script injection in workflow expressions, and implementing…
GitHub CI Fix Debugging
Debug and fix failing GitHub PR checks by inspecting GitHub Actions logs, summarizing failure context, drafting fix plans, and implementing fixes after approval.
robin
Use whenever an agent creates, updates, reviews, or completes a GitHub pull request. Detect whether Robin is installed in the repository; when it is, automatically drive the PR through a bounded review, verified-fix, reply, thread-resolution, re-review, authorized-merge, and cleanup loop without requiring the user to…
ci-review
CI-optimized code review: multi-agent parallel review with confidence scoring and atomic GitHub PR review posting. Runs specialized review agents, scores findings, and submits a GitHub PR review via post-review.sh. Always executes post-review.sh to submit a review on every run (including zero-findings runs). Triggers…