A static analysis tool designed to audit GitHub Actions workflow files for cache poisoning vulnerabilities and sensitive path leakage.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install github-actions-cache-hardening-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install github-actions-cache-hardening-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is GitHub Actions Cache Hardening Audit?
The GitHub Actions Cache Hardening Audit is a specialized security tool within the Openclaw Skills ecosystem that performs static analysis on .github/workflows/*.yml files. It is specifically designed to identify high-risk patterns in workflow caching that could lead to cache poisoning, stale build artifacts, or the accidental exposure of sensitive credentials. By integrating this skill, developers can ensure their CI/CD pipelines adhere to security best practices and prevent supply chain attacks originating from untrusted triggers.
This skill helps maintain the integrity of your build environment by scanning for common misconfigurations in actions/cache usage. Utilizing Openclaw Skills for security auditing allows teams to automate the detection of floating action references and overly broad restore-key prefixes that often go unnoticed in manual reviews.
GitHub Actions Cache Hardening Audit Use Cases
- Detecting cache poisoning risks in workflows triggered by pull_request_target.
- Identifying missing hashFiles calls in cache keys which lead to non-deterministic builds.
- Scanning for sensitive directories like .aws or .ssh that may be incorrectly included in cache paths.
- Enforcing version pinning for cache actions to mitigate supply chain vulnerabilities.
- Automating security compliance checks for GitHub Actions across large repositories.
How GitHub Actions Cache Hardening Audit Works
- The skill scans the specified directory for workflow files using the defined WORKFLOW_GLOB pattern.
- It parses the YAML content of each workflow to locate any usage of caching actions.
- A scoring algorithm evaluates the workflow against security heuristics, such as trigger type and key specificity.
- It identifies sensitive file paths and floating references that deviate from hardening standards.
- The tool generates a detailed report in either text or JSON format, highlighting warning and critical risks.
- If configured as a fail gate, the skill returns a non-zero exit code to halt CI processes when critical vulnerabilities are found.
GitHub Actions Cache Hardening Audit Setup
To use this tool from the Openclaw Skills collection, ensure you have bash and python3 available in your environment. Run a standard audit with the following command:
WORKFLOW_GLOB='.github/workflows/*.yml' \
bash skills/github-actions-cache-hardening-audit/scripts/cache-hardening-audit.sh
To integrate it into a CI/CD pipeline as a blocking security check, use the following configuration:
WORKFLOW_GLOB='.github/workflows/*.yml' \
OUTPUT_FORMAT=json \
FAIL_ON_CRITICAL=1 \
bash skills/github-actions-cache-hardening-audit/scripts/cache-hardening-audit.sh
GitHub Actions Cache Hardening Audit Data Schema & Taxonomy
The skill organizes its audit results into a structured format. When using JSON output, the data follows this schema:
| Key | Type | Description |
|---|---|---|
summary |
Object | High-level overview of total workflows scanned and flagged. |
flagged_workflows |
Array | List of workflows containing warnings or low-level risks. |
critical_workflows |
Array | List of workflows that met or exceeded the CRITICAL_SCORE threshold. |
score |
Integer | The calculated risk weight for a specific workflow file. |
GitHub Actions Cache Hardening Audit Advanced Features
- Custom risk scoring through WARN_SCORE and CRITICAL_SCORE environment variables to match team risk tolerance.
- Regex-based workflow filtering using WORKFLOW_FILE_MATCH and WORKFLOW_FILE_EXCLUDE for targeted auditing.
- Support for multiple output formats, enabling seamless integration with other Openclaw Skills reporting tools.
- Built-in fixture testing to validate audit logic against known vulnerable workflow patterns.
SKILL.md
Loading
Related Openclaw Skills
GitHub Actions Branch Drift Audit
A specialized audit tool to identify branch-level CI reliability regressions and performance drift compared to mainline releases.
GitHub Actions Artifact Budget Audit
Audit GitHub Actions artifact storage from JSON exports to identify and flag oversized artifacts before they inflate CI costs.
GitHub Actions Actor Reliability Audit
An automated auditing tool that ranks GitHub Actions reliability by identifying high-risk contributors and flaky automation owners through run history analysis.
Env Alias Audit
A robust auditing tool to detect environment variable alias conflicts and missing required configurations before deployment.
GitHub Actions Cancel Waste Audit
Audit and quantify wasted GitHub Actions runtime from cancelled or timed-out runs to eliminate flaky workflow churn and save CI budget.
GitHub Actions Commit Health Audit
A specialized audit tool that identifies specific commits causing repeated GitHub Actions workflow failures to help teams prioritize fixes or rollbacks.
METADATA
Featured*
