An automated auditing tool to identify and mitigate secret exposure risks within GitHub Actions workflow configurations.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install github-actions-secret-exposure-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install github-actions-secret-exposure-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is GitHub Actions Secret Exposure Audit?
This skill provides a critical security layer for modern CI/CD pipelines by scanning GitHub Actions workflow YAML files for common credential leak patterns. It is designed to identify high-risk configurations such as the usage of sensitive secrets within pull_request_target triggers, which can lead to unauthorized access in public repositories. By incorporating this tool into your library of Openclaw Skills, developers can proactively detect shell commands that echo secrets or the passing of sensitive data to unpinned, third-party actions that may pose a supply chain risk.
GitHub Actions Secret Exposure Audit Use Cases
- Auditing existing repositories to identify and remediate legacy security technical debt.
- Implementing pre-commit or pre-push security scanning for all workflow changes.
- Establishing an automated CI/CD gate to block pull requests containing unsafe secret patterns.
- Identifying unpinned third-party actions that require version pinning for improved security posture.
How GitHub Actions Secret Exposure Audit Works
- The skill starts by locating workflow files based on the specified glob pattern, usually targeting the .github/workflows directory.
- It parses the YAML structure of each identified workflow to map out triggers, jobs, and individual steps.
- It runs a series of heuristic checks to detect secret echoing, usage of sensitive secrets in risky triggers, and unpinned action references.
- Each workflow is evaluated and assigned a risk score based on the severity of the detected patterns.
- The skill generates a comprehensive report in either text or JSON format and can be configured to exit with an error code to fail a build if critical vulnerabilities are found.
GitHub Actions Secret Exposure Audit Setup
To integrate this audit into your local environment or pipeline using Openclaw Skills, you can run the following bash command:
WORKFLOW_GLOB='.github/workflows/*.yml' \
WARN_SCORE=4 \
CRITICAL_SCORE=8 \
bash skills/github-actions-secret-exposure-audit/scripts/secret-exposure-audit.sh
For environments requiring automated reporting and failure gating, use the following configuration:
WORKFLOW_GLOB='.github/workflows/*.y*ml' \
OUTPUT_FORMAT=json \
FAIL_ON_CRITICAL=1 \
bash skills/github-actions-secret-exposure-audit/scripts/secret-exposure-audit.sh
GitHub Actions Secret Exposure Audit Data Schema & Taxonomy
The skill manages security data through a series of environment variables and outputs structured reports. The following parameters define the scan behavior:
| Parameter | Default | Description |
|---|---|---|
| WORKFLOW_GLOB | .github/workflows/.yml | Defines the file path pattern for scanning |
| OUTPUT_FORMAT | text | Sets the report format to either text or json |
| WARN_SCORE | 4 | The numerical threshold to trigger a warning status |
| CRITICAL_SCORE | 8 | The numerical threshold to trigger a critical status |
| FAIL_ON_CRITICAL | 0 | Enables (1) or disables (0) the CI fail gate |
GitHub Actions Secret Exposure Audit Advanced Features
- Customizable regex filtering for including or excluding specific workflow files from the audit.
- Detailed scoring system that prioritizes the most dangerous security risks for rapid remediation.
- Support for ALLOW_REF_REGEX to whitelist specific, trusted action versions while flagging others.
- Multi-format output (JSON/Text) designed for both human readability and machine processing.
- Native compatibility with Openclaw Skills for seamless multi-agent security automation.
SKILL.md
Loading
Related Openclaw Skills
GitHub Actions Runtime Regression Audit
Analyze and compare GitHub Actions runtime metrics to detect performance regressions and optimize CI costs.
GitHub Actions Run Gap Audit
A diagnostic tool to identify GitHub Actions workflows that have missed their expected execution cadence.
GitHub Actions Retry Recovery Audit
Analyze GitHub Actions run history to identify and quantify the cost of flaky fail-then-success retry patterns.
GitHub Actions Rerun Waste Audit
A technical auditing tool to quantify wasted GitHub Actions minutes by analyzing workflow reruns and flakiness data.
GitHub Actions Self-Hosted Risk Audit
A specialized security auditing tool for identifying high-risk configurations in GitHub Actions workflows utilizing self-hosted runners.
GitHub Actions SHA Rerun Debt Audit
Audit GitHub Actions rerun debt to identify and eliminate commit-level CI inefficiencies.
METADATA
Featured*
