A specialized linter for GitHub Actions YAML files to detect security risks, deprecated actions, and syntax errors.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install github-actions-linter
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install github-actions-linter using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is GitHub Actions Linter?
This skill provides a comprehensive suite of tools for validating GitHub Actions workflow files. By utilizing the provided Python script, developers can perform deep audits on their CI/CD pipelines to ensure adherence to best practices and security standards. It is an essential component for teams using Openclaw Skills to automate their development lifecycle, offering detection for shell injection, hardcoded secrets, and outdated action versions.
GitHub Actions Linter Use Cases
- Auditing existing GitHub Actions workflows for security vulnerabilities like shell injection or hardcoded secrets.
- Validating the syntax and structure of new .github/workflows/*.yml files during development.
- Identifying and upgrading deprecated action versions or runner labels to maintain pipeline health.
- Automating workflow linting within a CI/CD process to enforce consistent standards across a repository using Openclaw Skills.
How GitHub Actions Linter Works
- The user provides a workflow file or directory to the Python-based linter script.
- The linter parses the YAML structure and evaluates it against 28 distinct rules across syntax, security, and best practices.
- A security audit scans for specific risks like untrusted event contexts and permissive permissions.
- A deprecation check compares used actions against known outdated versions.
- Results are generated in the requested format (Text, JSON, or Markdown) for review or automated consumption.
GitHub Actions Linter Setup
To install and use this skill within Openclaw Skills, ensure you have Python 3 installed. You can execute the linter directly from your terminal using the following commands:
# Run general linting on a directory
python3 scripts/gha_linter.py lint .github/workflows/ --strict
# Run a security audit on a specific file
python3 scripts/gha_linter.py security .github/workflows/main.yml
# Check for deprecated actions
python3 scripts/gha_linter.py deprecated .github/workflows/main.yml
GitHub Actions Linter Data Schema & Taxonomy
The skill produces structured feedback regarding workflow health. It categorizes issues based on a set of 28 predefined rules:
| Category | Rules Covered |
|---|---|
| Syntax & Structure | Missing triggers, empty jobs, circular dependencies, and missing runs-on labels. |
| Security | Shell injection detection, hardcoded secrets, permissive permissions, and untrusted contexts. |
| Deprecated | Outdated action versions, deprecated runner labels, and legacy command usage. |
| Best Practices | Timeout settings, step naming, concurrency management, and runner optimization. |
GitHub Actions Linter Advanced Features
- Multi-format output support (JSON, Text, Markdown) for seamless integration with other tools in the Openclaw Skills ecosystem.
- Strict mode configuration via the --strict flag to treat all warnings as build-failing errors.
- Recursive directory scanning for bulk auditing of large enterprise repositories.
- Specialized security module for detecting complex attack vectors like pull_request_target exploitation.
- Automated CI/CD integration examples provided for self-linting workflows.
SKILL.md
Loading
Related Openclaw Skills
CSP Policy Generator
A specialized security utility to generate, validate, and refine Content Security Policy (CSP) headers through automated resource discovery and risk analysis.
Service Catalog
An automated infrastructure discovery tool that builds a living service inventory by scanning Docker, Kubernetes, and application configurations.
Secrets Audit
A high-performance security scanner for detecting hardcoded credentials, API keys, and sensitive tokens within codebases and git histories.
Verified Agent Identity
A comprehensive toolkit for AI agents to manage decentralized identities, sign challenges, and establish verifiable links to human owners on the Billions Network.
Backpressure Analyzer
A diagnostic and optimization tool for detecting processing bottlenecks and implementing flow control in data streaming pipelines.
Monorepo Analyzer
A comprehensive auditing tool for identifying workspace structures, internal dependencies, and architectural issues in monorepos.
Featured*
