A static analysis tool to identify security hardening gaps in GitHub Actions workflow files before they reach production.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install github-actions-workflow-hardening-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install github-actions-workflow-hardening-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is GitHub Actions Workflow Hardening Audit?
The GitHub Actions Workflow Hardening Audit is a specialized tool within the Openclaw Skills ecosystem designed to perform static analysis on CI/CD configuration files. It proactively identifies security risks in .github/workflows/*.yml files, such as missing timeouts, overly permissive tokens, and the use of mutable action references.
By integrating this skill into your development workflow, you can enforce high-security standards across monorepos and complex project structures. It empowers developers to maintain a hardened security posture by flagging risky defaults before they are deployed to production environments.
GitHub Actions Workflow Hardening Audit Use Cases
- Enforcing CI/CD security gates by failing builds that contain critical hardening gaps.
- Auditing large-scale monorepos to identify workflows missing concurrency controls or strict permission sets.
- Detecting and migrating floating action references (like @main or @v4) to immutable commit SHAs for supply chain security.
- Filtering audits to focus specifically on high-risk triggers such as pull_request_target.
How GitHub Actions Workflow Hardening Audit Works
- The skill scans the repository for workflow files matching the defined glob pattern.
- It parses each YAML file to evaluate structural security elements, including job-level permissions and timeout-minutes.
- Action references are checked against security best practices to detect floating tags or unauthorized external actions.
- A risk score is calculated for each file based on user-defined thresholds for warning and critical severities.
- The skill outputs a detailed report in text or JSON format and can trigger a non-zero exit code to block insecure deployments.
GitHub Actions Workflow Hardening Audit Setup
To utilize this Openclaw Skills resource, ensure your environment has bash and python3. You can execute a standard audit using the following command:
WORKFLOW_GLOB='.github/workflows/*.y*ml' \
bash skills/github-actions-workflow-hardening-audit/scripts/workflow-hardening-audit.sh
For automated CI environments, you can enable failure gates:
FAIL_ON_CRITICAL=1 \
OUTPUT_FORMAT=json \
bash skills/github-actions-workflow-hardening-audit/scripts/workflow-hardening-audit.sh
GitHub Actions Workflow Hardening Audit Data Schema & Taxonomy
The skill generates a structured audit report with the following metadata taxonomy:
| Attribute | Description |
|---|---|
| Risk Score | A numerical value calculated based on identified hardening gaps. |
| Severity | Categorization of the workflow status (ok, warn, or critical). |
| Flags | Specific indicators for missing timeouts, permissions, or concurrency. |
| Action Refs | Identification of floating tags vs. pinned SHAs for supply chain auditing. |
GitHub Actions Workflow Hardening Audit Advanced Features
- Support for regex-based inclusion and exclusion filters for both file paths and event triggers.
- Configurable scoring system via WARN_SCORE and CRITICAL_SCORE variables to match organizational risk tolerance.
- Selective requirement toggles for specific security features like REQUIRE_CONCURRENCY or REQUIRE_PERMISSIONS.
- Native JSON output mode for easy integration with downstream security dashboards and data aggregators.
SKILL.md
Loading
Related Openclaw Skills
GitHub Actions Trigger Health Audit
A diagnostic tool for identifying flaky GitHub Actions workflows by analyzing failure rates across specific trigger events and repositories.
GitHub Actions Timeout Risk Audit
Proactively identify and fix near-timeout GitHub Actions jobs before they break your CI pipeline.
GitHub Actions Stuck Run Audit
A monitoring skill designed to detect and alert on GitHub Actions workflows that remain in queued or in-progress states for excessive periods.
GitHub Actions Step Flake Audit
Identify and rank flaky GitHub Actions steps by analyzing success and failure outcomes across multiple workflow runs.
JUnit Failure Fingerprint
Cluster noisy JUnit test failures into stable, repeatable fingerprints to streamline CI triage and identify root causes.
Prisma Migrate Guard
A pre-deployment health check tool for Prisma migrations that prevents broken database states in production.
METADATA
Featured*
