mirror of
https://github.com/trailofbits/skills
synced 2026-06-21 14:12:00 +00:00
Jonathan Hefner
debfb29c8e
* Fix `allowed-tools` to use spec-compliant space-delimited strings Per the agentskills.io specification, `allowed-tools` must be a single string of space-delimited patterns, not a YAML list. Converted all 23 SKILL.md files from the `- Item` list format to the correct `"Item1 Item2"` string format. Also updated the frontmatter examples in CLAUDE.md and the workflow-skill-design skill template to match. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix remaining allowed-tools format in firebase-apk-scanner and workflow-skill-design docs - Convert firebase-apk-scanner from comma-separated to space-delimited - Update anti-patterns.md and tool-assignment-guide.md examples from YAML lists to space-delimited strings - Remove unnecessary quotes from SKILL.md template placeholder Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Cover commands, new SKILL.md files, and fix template placeholder Extends the previous spec-compliance fixes: * Convert command frontmatter (commands/*.md) — per Claude Code docs, command files use the same frontmatter as skills, so the same space-delimited rule applies. * Convert three SKILL.md files added since the original PR: mutation-testing, trailmark-structural, trailmark-summary. * Fix the placeholder in the workflow-skill-design template. The previous "[minimum tools needed, space-delimited]" was YAML flow-sequence syntax, which parses as a list — the opposite of what the placeholder claims. Replaced with a concrete-looking space-delimited example plus a comment. Zeroize-audit agent files still use `allowed-tools:` in YAML list form. They are intentionally excluded: per the project's own docs (workflow-skill-design references), agents declare tools with `tools:` (not `allowed-tools:`). Fixing those requires changing the field name as well as the format and is out of scope for this PR. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * zeroize-audit agents: switch allowed-tools to tools Subagents declare their tool allowlist via `tools:` (comma-separated), not `allowed-tools:` — see Claude Code's subagent docs and this repo's own designing-workflow-skills/SKILL.md:47: > Skills use `allowed-tools:` in frontmatter. Agents use `tools:` > in frontmatter. Before this change, the zeroize-audit agents declared their tool list under `allowed-tools:`, which Claude Code does not read for subagents. The field was effectively a no-op; the spawned agents had no tool restriction enforced. Renames the field on all 11 agents to `tools:` and reformats the YAML list as comma-separated to match the documented format and existing agents elsewhere in the repo (e.g. function-analyzer.md, spec-compliance-checker.md). Tool sets are unchanged. Behavior change: tools now actually constrain what each spawned agent can call. The lists are the ones the original author intended. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * skill-improver: convert command allowed-tools to space-delimited The two command files in plugins/skill-improver/commands/ still used the JSON flow-array format (`allowed-tools: ["..."]`), which the rest of this PR converted everywhere else. Convert them to the spec-compliant space-delimited string form for consistency. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Dan Guido <dan@trailofbits.com>
agentic-actions-auditor
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations. Detects misconfigurations and attack vectors specific to Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference when used in CI/CD pipelines.
What It Does
This plugin provides a security audit skill that analyzes GitHub Actions workflow YAML files for vulnerabilities arising from AI agent integrations. It focuses on scenarios where attacker-controlled input (pull request titles, branch names, issue bodies, comments, commit messages, file contents, environment variables) can reach an AI agent running with elevated permissions in CI.
Attack Vectors Detected
The skill checks for nine categories of security issues:
- A. Env Var Intermediary -- Attacker data flows through
env:blocks to AI prompt fields with no visible${{ }}expressions - B. Direct Expression Injection --
${{ github.event.* }}expressions embedded directly in AI prompt fields - C. CLI Data Fetch --
ghCLI commands in prompts fetch attacker-controlled content at runtime - D. PR Target + Checkout --
pull_request_targettrigger combined with checkout of PR head code - E. Error Log Injection -- CI error output or build logs fed to AI prompts carry attacker payloads
- F. Subshell Expansion -- Restricted tools like
echoallow subshell expansion (echo $(env)) bypass - G. Eval of AI Output -- AI response flows to
eval,exec, or unquoted$()in subsequent steps - H. Dangerous Sandbox Configs --
danger-full-access,Bash(*),--yolodisable safety protections - I. Wildcard Allowlists --
allowed_non_write_users: "*"orallow-users: "*"permit any user to trigger
Supported AI Actions
| Action | Repository | Notes |
|---|---|---|
| Claude Code Action | anthropics/claude-code-action | |
| Gemini CLI | google-github-actions/run-gemini-cli | Primary |
| Gemini CLI (legacy) | google-gemini/gemini-cli-action | Archived |
| OpenAI Codex | openai/codex-action | |
| GitHub AI Inference | actions/ai-inference |
Installation
From a project with the Trail of Bits internal marketplace configured:
/plugin menu
Select agentic-actions-auditor from the Security Tooling section.
Skills Included
| Skill | Description |
|---|---|
| agentic-actions-auditor | Audits GitHub Actions workflow files for AI agent security vulnerabilities |
Target Audience
- Security auditors reviewing repositories that use AI agents in CI/CD
- Developers configuring Claude Code Action, Gemini CLI, OpenAI Codex, or GitHub AI Inference in their workflows
- DevSecOps engineers establishing secure defaults for AI-assisted code review pipelines
Usage
Once installed, the skill activates automatically when Claude detects GitHub Actions workflow files (.github/workflows/*.yml) containing AI agent action references. You can also invoke it directly:
Audit the GitHub Actions workflows in this repository for AI agent security issues.
The skill produces a structured findings report covering each applicable attack vector with severity ratings and remediation guidance.