A security auditing tool for GitHub Actions that identifies OIDC misconfigurations and risky cloud authentication patterns.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install github-actions-oidc-hardening-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install github-actions-oidc-hardening-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is GitHub Actions OIDC Hardening Audit?
The GitHub Actions OIDC Hardening Audit is a specialized security tool designed to scan workflow YAML files for identity and secret exposure risks. By analyzing cloud authentication patterns for AWS, GCP, and Azure, this Openclaw Skills entry ensures that developers are utilizing OpenID Connect (OIDC) correctly, avoiding static credentials, and maintaining strict permission scopes.
This skill helps teams transition from risky long-lived secrets to short-lived tokens, significantly reducing the attack surface of CI/CD pipelines. It provides automated detection of common misconfigurations that lead to unauthorized cloud access or secret leaks.
GitHub Actions OIDC Hardening Audit Use Cases
- Identifying GitHub Actions workflows missing mandatory id-token write permissions for OIDC.
- Detecting the use of static AWS access keys or GCP service account keys instead of secure IAM roles.
- Auditing repositories for floating action versions that pose supply chain risks.
- Implementing a CI/CD fail-gate to prevent insecure workflow changes from being merged into production.
How GitHub Actions OIDC Hardening Audit Works
- The skill scans the repository for workflow YAML files using a configurable glob pattern.
- It searches for specific cloud authentication actions, including those for AWS, Google Cloud, and Azure.
- A logic engine evaluates the configuration against security best practices, such as verifying the id-token permission and role assumption parameters.
- It calculates a risk score based on detected gaps, such as floating action references or hardcoded credentials.
- The audit produces a final report in text or JSON format, with optional exit codes to trigger CI/CD failures on critical risks.
GitHub Actions OIDC Hardening Audit Setup
To integrate this into your workflow with Openclaw Skills, ensure your environment has bash and python3. Execute the script using the following command:
WORKFLOW_GLOB='.github/workflows/*.yml' \
WARN_SCORE=3 \
CRITICAL_SCORE=7 \
bash skills/github-actions-oidc-hardening-audit/scripts/oidc-hardening-audit.sh
To enable a fail gate for automation pipelines:
OUTPUT_FORMAT=json \
FAIL_ON_CRITICAL=1 \
bash skills/github-actions-oidc-hardening-audit/scripts/oidc-hardening-audit.sh
GitHub Actions OIDC Hardening Audit Data Schema & Taxonomy
The skill utilizes environment variables for configuration and produces structured output based on the following schema:
| Variable | Type | Description |
|---|---|---|
| WORKFLOW_GLOB | String | Glob pattern for target YAML files |
| OUTPUT_FORMAT | String | text or json output |
| WARN_SCORE | Integer | Minimum score to trigger a warning (default: 3) |
| CRITICAL_SCORE | Integer | Minimum score to trigger a critical failure (default: 7) |
| FAIL_ON_CRITICAL | Boolean | If 1, the script exits with code 1 when critical issues are found |
GitHub Actions OIDC Hardening Audit Advanced Features
- Custom regex support for allow-listing specific action reference tags.
- Automated detection of static cloud credential keys (e.g., AWS_SECRET_ACCESS_KEY) within workflow files.
- High-granularity scoring system to prioritize the most severe security vulnerabilities.
- Machine-readable JSON output for easy integration with external security dashboards or reporting tools.
SKILL.md
Loading
Related Openclaw Skills
GitHub Actions Merge Queue Health Audit
A diagnostic tool for auditing GitHub merge queue workflows using failure rates, queue latency, and stale-success risk scoring.
GitHub Actions Manual Trigger Audit
A diagnostic tool to detect and audit manual trigger reliance in GitHub Actions workflows to improve automation and pipeline reliability.
GitHub Actions Mainline Health Audit
A diagnostic tool that scores the reliability of GitHub Actions workflows on protected branches to detect silent delivery degradation.
GitHub Actions Incident Timeline Audit
A specialized tool to cluster noisy GitHub Actions failure logs into structured incident windows for better CI reliability reporting.
GitHub Actions Permission Scope Audit
A security-focused tool to detect and audit over-privileged GitHub Actions workflow tokens to enforce least-privilege access.
GitHub Actions PR Gate Health Audit
A diagnostic tool to score and flag unreliable GitHub Actions workflows used in pull request and merge queue gates.
METADATA
Featured*
