{ "$schema": "https://readbeforerun.ai/schema/entry.schema.json", "entry": { "id": "trailofbits-agentic-actions-auditor", "name": "Trail of Bits Agentic Actions Auditor", "summary": "Claude Code plugin that statically audits GitHub Actions workflows which invoke AI coding agents for injection and permission flaws.", "draft": "review", "type": "plugin", "mission": [ "agent-security" ], "task": [ "agent-supply-chain-scan", "code-review-sast" ], "domain": [ "ai-security", "application-security" ], "runtime": [ "claude-code", "codex" ], "tier": "listed", "last_checked": "2026-10-19", "next_check": "2027-01-17", "freshness": "fresh", "superseded": false, "in_my_kit": null, "advice": null, "code_shows": "runs shell commands or eval · has broad pre-approvals", "source": { "repo": "https://github.com/trailofbits/skills", "subpath": "plugins/agentic-actions-auditor", "commit": "5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0", "version": "1.3.2", "license": "CC-BY-SA-4.0" }, "install": { "skills_cli": null, "claude_code": null, "upstream": "/plugin marketplace add trailofbits/skills\n/plugin menu", "bundled": false }, "scan": { "status": "static scan pending (not run)" }, "reach": { "method": "reach-v0.1", "level": 2, "level_source": "static", "level_label": "open", "unknown_axes": 0, "verdict": "not-run", "badge": "reach 2 · not run yet", "long": "reach 2 from code (open); lab: not run yet", "declared": { "fs": 0, "net": 1, "exec": 1, "cred": 1, "hitl": 2 }, "static": { "level": 2, "fs": 0, "net": 1, "exec": 2, "cred": 1, "persist": 0, "hitl": 2, "unknown": [] }, "observed": null, "surplus": null, "fit": null, "exports": { "aivss": { "fs": 0, "net": 0.5, "exec": 0.5, "cred": 0.5, "persist": 0, "hitl": 0.5 }, "usf_risk_tier": "L2" } }, "profile": { "read_at": "5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0", "read_on": "2026-10-25", "overview": "A Claude Code plugin whose single skill guides the AI client's model through a static audit of GitHub Actions workflows that invoke Claude Code Action, Gemini CLI, OpenAI Codex or GitHub AI Inference, tracing where attacker-controlled input reaches the agent.", "purpose": [ "Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines.", "Produces a structured findings report per attack vector with severity ratings and remediation guidance." ], "use_cases": [ { "text": "Audit a repository's GitHub Actions workflows for AI agent security issues", "task": "code-review-sast" }, { "text": "Check whether attacker-controlled input can reach AI agent prompts in workflows", "task": "code-review-sast" }, { "text": "Evaluate agentic action configurations: sandbox settings, tool permissions and user allowlists", "task": "agent-supply-chain-scan" }, { "text": "Assess trigger events such as pull_request_target and issue_comment that expose workflows to external input", "task": "code-review-sast" } ], "maturity": null, "capabilities": [ { "name": "Step 0: Determine Analysis Mode", "effects": [ "reads", "runs-commands" ], "enabled": "optional" }, { "name": "Step 1: Discover Workflow Files", "effects": [ "reads" ], "enabled": "default" }, { "name": "Step 2: Identify AI Action Steps", "effects": [ "reads" ], "enabled": "default" }, { "name": "Cross-File Resolution", "effects": [ "reads", "runs-commands" ], "enabled": "default" }, { "name": "Step 3: Capture Security Context", "effects": [ "reads" ], "enabled": "default" }, { "name": "Step 4: Analyze for Attack Vectors", "effects": [ "reads" ], "enabled": "default" } ], "effects": [ "reads", "runs-commands" ], "runs": "in-client", "listens": [], "sends_to": [ { "to": "GitHub API (named repository)", "kind": "target", "when": "optional" }, { "to": "GitHub API (referenced repositories)", "kind": "other", "when": "default" } ], "model": "client", "needs": [ { "kind": "runtime", "text": "Claude Code with the trailofbits/skills plugin marketplace added; the root README also documents Codex." }, { "kind": "tools", "text": "The GitHub CLI (gh) for remote analysis mode and remote cross-file fetches." }, { "kind": "credentials", "text": "An authenticated gh session (gh auth login) for remote fetches." }, { "kind": "credentials", "text": "Private repositories are reachable when the gh token in use has permissions for them." } ] }, "urls": { "page": "/catalog/trailofbits-agentic-actions-auditor/", "json": "/entries/trailofbits-agentic-actions-auditor.json", "md": "/catalog/trailofbits-agentic-actions-auditor.md", "badge": "/badge/trailofbits-agentic-actions-auditor.svg" } }, "data": { "schema_version": "0.5", "slug": "trailofbits-agentic-actions-auditor", "name": "Trail of Bits Agentic Actions Auditor", "summary": "Claude Code plugin that statically audits GitHub Actions workflows which invoke AI coding agents for injection and permission flaws.", "draft": "review", "in_my_kit": null, "type": "plugin", "mission": [ "agent-security" ], "task": [ "agent-supply-chain-scan", "code-review-sast" ], "domain": [ "ai-security", "application-security" ], "phase": [ "ais:release" ], "role": [ "ai-platform" ], "runtime": [ "claude-code", "codex" ], "auth": null, "autonomy": null, "addresses": [], "frameworks": { "owasp_ast": [], "owasp_asi": [], "attack_tactic": [], "atlas": [] }, "source": { "repo": "https://github.com/trailofbits/skills", "subpath": "plugins/agentic-actions-auditor", "commit": "5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0", "version": "1.3.2", "license": "CC-BY-SA-4.0", "manifest": "plugin.json", "also_listed": {} }, "upstream": { "checked_at": "2026-10-19", "updated_at": "2026-10-15", "current_release": null, "archived": false, "stars": 7640, "commit_history": {}, "releases_since_pin": 0 }, "install": { "upstream": "/plugin marketplace add trailofbits/skills\n/plugin menu", "upstream_evidence": "README.md#L12-18", "bundled": false }, "scan": [ { "tool": "cisco-skill-scanner", "version": "not-run", "llm_judge": false, "date": "2026-10-19", "result": "pending" } ], "privileges": { "method": "reach-v0.1", "declared": { "axes": { "fs": 0, "net": 1, "exec": 1, "cred": 1, "hitl": 2 }, "evidence": { "fs": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L26 author states the skill reports findings and does not modify files", "net": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L50 author declares a remote mode for a GitHub repository the user names", "exec": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L99-101 author limits Bash to gh api and gh auth status", "cred": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L91-92 author says remote mode needs the user's own gh login", "hitl": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L4 frontmatter pre-approves the Bash tool with no command pattern" } }, "static": { "level": 2, "axes": { "fs": 0, "net": 1, "exec": 2, "cred": 1, "persist": 0, "hitl": 2 }, "evidence": { "fs": "none found: patterns fs-v0.1 in 5 files at 5c99c03", "net": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/cross-file-resolution.md#L88 gh api fetches referenced workflows from the GitHub API", "exec": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L4 Bash with no command pattern in allowed-tools permits any shell command", "cred": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L101 the only credential touch is the user's own gh login", "persist": "none found: patterns persist-v0.1 in 5 files at 5c99c03", "hitl": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L4 frontmatter pre-approves Bash with no command pattern, which equals broad pre-approval" }, "unknown": [] }, "min_config": { "status": "derived", "claude_code": "scope Bash to gh api and gh auth status only; the skill itself never needs write access", "note": "derived from the code, not tested in the lab" }, "override": null, "reviews": [] }, "status": { "tier": "listed", "last_checked": "2026-10-19", "next_check": "2027-01-17", "freshness": "fresh", "superseded": false, "superseded_by": null, "added": "2026-10-19", "added_by": "scout" }, "evidence": { "runs": [], "badge": "/badge/trailofbits-agentic-actions-auditor.svg" }, "changes": [] }, "profile": { "schema_version": "0.1", "entry": "trailofbits-agentic-actions-auditor", "draft": "review", "commit": "5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0", "read_on": "2026-10-25", "check": { "date": "2026-10-25", "facts": 47, "confirmed": 47, "verified": 42 }, "overview": { "text": "A Claude Code plugin whose single skill guides the AI client's model through a static audit of GitHub Actions workflows that invoke Claude Code Action, Gemini CLI, OpenAI Codex or GitHub AI Inference, tracing where attacker-controlled input reaches the agent.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L3 frontmatter description" }, "purpose": [ { "text": "Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L3 frontmatter description" }, { "text": "Produces a structured findings report per attack vector with severity ratings and remediation guidance.", "ev": "plugins/agentic-actions-auditor/README.md#L63 Usage section" } ], "use_cases": [ { "text": "Audit a repository's GitHub Actions workflows for AI agent security issues", "task": "code-review-sast", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L13 When to Use" }, { "text": "Check whether attacker-controlled input can reach AI agent prompts in workflows", "task": "code-review-sast", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L15 When to Use" }, { "text": "Evaluate agentic action configurations: sandbox settings, tool permissions and user allowlists", "task": "agent-supply-chain-scan", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L16 When to Use" }, { "text": "Assess trigger events such as pull_request_target and issue_comment that expose workflows to external input", "task": "code-review-sast", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L17 When to Use" } ], "not_for": [ { "text": "Not for runtime prompt injection testing; the author calls it static analysis guidance, not exploitation.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L24 When NOT to Use" }, { "text": "Not for non-GitHub CI/CD systems such as Jenkins, GitLab CI or CircleCI.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L25 When NOT to Use" }, { "text": "Not for auto-fixing or modifying workflow files; the skill reports findings and does not modify files.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L26 When NOT to Use" } ], "capabilities": { "coverage": "complete", "groups": [ { "name": "Step 0: Determine Analysis Mode", "does": "Parses owner/repo or a GitHub URL with optional ref and fetches the workflow directory listing and file contents with gh api (remote analysis mode).", "effects": [ "reads", "runs-commands" ], "enabled": "optional", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L68-74 remote fetch commands" }, { "name": "Step 1: Discover Workflow Files", "does": "Globs .github/workflows/*.yml and *.yaml at the repository root and reads each workflow file.", "effects": [ "reads" ], "enabled": "default", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L111 local discovery" }, { "name": "Step 2: Identify AI Action Steps", "does": "Matches each step's uses: against five known AI action references and records file, job, step, action reference and type.", "effects": [ "reads" ], "enabled": "default", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L124 AI step identification" }, { "name": "Cross-File Resolution", "does": "Resolves local composite actions and local or remote reusable workflows referenced by uses:, one level deep, reading from disk or via gh api.", "effects": [ "reads", "runs-commands" ], "enabled": "default", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/cross-file-resolution.md#L15 remote reusable workflow fetch" }, { "name": "Step 3: Capture Security Context", "does": "Captures with: fields per action type, trigger events, env: blocks at three scopes and permissions: blocks for each AI action step.", "effects": [ "reads" ], "enabled": "default", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L164 security context capture" }, { "name": "Step 4: Analyze for Attack Vectors", "does": "Checks vectors A to I (injection paths, eval of AI output, dangerous sandbox configs, wildcard allowlists) using the per-vector reference files.", "effects": [ "reads" ], "enabled": "default", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L232 vector analysis" } ] }, "architecture": { "summary": { "text": "Markdown instructions (SKILL.md plus reference files) that the AI client's model follows with Read, Grep, Glob and Bash; it reads local .github/workflows files or calls gh api against the GitHub Contents API for remote repositories and referenced reusable workflows.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L4 allowed-tools frontmatter" }, "runs": { "where": "in-client", "text": "Runs as skill instructions inside Claude Code, activated when Claude detects workflow files with AI agent action references.", "ev": "plugins/agentic-actions-auditor/README.md#L57 Usage section" }, "modes": [ { "where": "in-client", "mode": "remote analysis mode", "switch": null, "text": "Remote analysis mode applies when the user gives a GitHub URL or owner/repo; otherwise local analysis mode is used.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L50 mode selection" } ], "parts": [ { "name": "SKILL.md (agentic-actions-auditor)", "zone": "client", "does": "SKILL.md holds the audit methodology Step 0 to Step 5 that the model follows in order.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L46 methodology" }, { "name": "references/ files", "zone": "client", "does": "Reference files: foundations, action-profiles, cross-file-resolution and vector-a to vector-i detection heuristics.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L324 detailed references" }, { "name": ".github/workflows files", "zone": "machine", "does": "Workflow YAML files under .github/workflows at the repository root, read in local analysis mode.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L120 scan scope" }, { "name": "gh CLI", "zone": "machine", "does": "The GitHub CLI, called through Bash for gh api fetches and gh auth status.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L100 Bash use" }, { "name": "GitHub Contents API", "zone": "outside", "does": "GitHub Contents API, the source of workflow, action.yml and reusable workflow files in remote fetches.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/cross-file-resolution.md#L44 Contents API fetch" } ], "listens": [], "connections": [ { "to": "GitHub API (named repository)", "kind": "target", "when": "optional", "what": "Fetches the workflow directory listing and base64-decoded workflow contents of the named repository via gh api.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L80 remote fetch" }, { "to": "GitHub API (referenced repositories)", "kind": "other", "when": "default", "what": "Fetches remote reusable workflows referenced by job-level uses: from their repositories at the given ref via gh api.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/cross-file-resolution.md#L86-88 remote reusable workflow fetch" } ], "model": { "who": "client", "text": "The AI client's model follows the skill's instructions; SKILL.md addresses the model directly ('This skill teaches you ...').", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L9 skill teaches the model" } }, "needs": [ { "kind": "runtime", "text": "Claude Code with the trailofbits/skills plugin marketplace added; the root README also documents Codex.", "ev": "README.md#L12 marketplace install" }, { "kind": "tools", "text": "The GitHub CLI (gh) for remote analysis mode and remote cross-file fetches.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L68 gh api use" }, { "kind": "credentials", "text": "An authenticated gh session (gh auth login) for remote fetches.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L91 auth error message" }, { "kind": "credentials", "text": "Private repositories are reachable when the gh token in use has permissions for them.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L92 404 handling" } ], "installer": [ { "text": "Adds the trailofbits/skills marketplace from GitHub with /plugin marketplace add, naming the repository without a ref or version; the plugin is then picked in /plugin menu.", "ev": "README.md#L12 marketplace add command" }, { "text": "The plugin README installs via /plugin menu in a project with the Trail of Bits internal marketplace configured, selecting agentic-actions-auditor in the Security Tooling section.", "ev": "plugins/agentic-actions-auditor/README.md#L35-41 plugin installation" }, { "text": "For Codex, the root README adds the marketplace with codex plugin marketplace add trailofbits/skills and installs with codex plugin add @trailofbits.", "ev": "README.md#L28-30 Codex install" } ], "limits": [ { "text": "The SKILL.md frontmatter lists Bash in allowed-tools next to Read, Grep and Glob, without a command pattern on Bash.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L4 allowed-tools" }, { "text": "Bash use is bounded by instruction: the skill tells the model to use Bash for gh api and gh auth status and never to pipe fetched content to a shell or interpreter.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L99-107 Bash Safety Rules" }, { "text": "Cross-file resolution stops at one level; references found inside resolved files are logged as unresolved.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/cross-file-resolution.md#L5 depth limit" }, { "text": "Remote actions referenced as owner/repo@ref outside .github/workflows/ are skipped silently and their action.yml is not fetched.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/cross-file-resolution.md#L17 classification table" }, { "text": "In Vector C the prompt tells the agent to fetch attacker-controlled content with gh CLI commands at runtime; the author notes the fetched content itself is invisible to static YAML analysis.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/vector-c-cli-data-fetch.md#L3 vector description" }, { "text": "Vector F (subshell expansion) is confirmed for Gemini CLI; for Claude Code Action and OpenAI Codex the author says it needs runtime testing to confirm exploitability.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/vector-f-subshell-expansion.md#L14 confidence note" }, { "text": "AI steps are identified by prefix-matching uses: against five listed action references, ignoring the version or ref after @.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L138 matching rules" }, { "text": "The skill tells the model not to pre-check gh auth status but to attempt the gh api call and handle auth or 404 failures afterwards.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L89 error handling" }, { "text": "Findings for dangerous sandbox configs (Vector H) or wildcard allowlists (Vector I) are rated Info or Low when no injection vector A to G occurs with them.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L276 severity rule for configuration-only findings" }, { "text": "Workflows that use no AI agent actions are out of scope; the author points to general Actions security tools for them.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L22 When NOT to Use" }, { "text": "Workflow discovery covers .github/workflows/ at the repository root; subdirectories, vendored code and test fixtures are not scanned.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L120 scan scope statement" }, { "text": "Standalone composite actions or reusable workflows are reviewed only through a caller workflow that references them via uses:.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L23 When NOT to Use" }, { "text": "Local actions whose runs.using is not composite (JavaScript or Docker actions) are skipped and not logged as unresolved, so the report's Unresolved References section does not list them.", "ev": "plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/cross-file-resolution.md#L56 type discrimination rule" } ], "not_found": [ { "field": "maturity", "searched": "plugins/agentic-actions-auditor/.claude-plugin/plugin.json, .claude-plugin/marketplace.json, both READMEs, SKILL.md for preview/experimental/alpha/beta/stable/deprecated (only version 1.3.2 found)" }, { "field": "capability_count", "searched": "plugins/agentic-actions-auditor/README.md and SKILL.md for a stated number of tools/skills/commands/steps; the author states nine categories of security issues, which fits no unit" }, { "field": "listen", "searched": "SKILL.md, plugin README, plugin.json, openai.yaml, references/*.md for servers, ports, host or bind settings; the subpath contains no executable code" }, { "field": "autonomy", "searched": "not applicable: entry type is plugin (skill), not agent" } ] }, "verdict": null, "runs": [] }