{
  "$schema": "/schemas/skill-manifest-v1.schema.json",
  "schemaVersion": 1,
  "name": "github-actions-hardening",
  "description": "Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and over-scoped tokens. Use this skill when asked to review, audit, harden, or secure a GitHub Actions workflow, when writing a new workflow, or for any request like \"is this workflow safe?\", \"review my CI for security issues\", \"why is pull_request_target dangerous here?\", \"pin my actions\", or \"lock down GITHUB_TOKEN permissions\". Covers script injection via ${{ }} interpolation, pull_request_target / workflow_run privilege escalation, SHA-pinning of third-party actions, least-privilege permissions, GITHUB_ENV/GITHUB_OUTPUT injection, secret exposure, OIDC over long-lived credentials, and self-hosted runner exposure on public repositories.",
  "license": null,
  "compatibility": null,
  "metadata": {},
  "revision": "291d5ac93ab061b43ab20c57c0335f7b39bcccdd",
  "generatedAt": "2026-07-26T23:35:15.967Z",
  "source": {
    "repository": "https://github.com/mleem97/mm-skills",
    "path": "github-actions-hardening",
    "ref": "291d5ac93ab061b43ab20c57c0335f7b39bcccdd"
  },
  "manifestUrl": "/registry/v1/skills/github-actions-hardening.json",
  "pageUrl": "/skills/github-actions-hardening",
  "fileCount": 8,
  "totalBytes": 25521,
  "clients": {
    "agents": {
      "label": "Shared Agent Skills",
      "user": "~/.agents/skills",
      "project": ".agents/skills"
    },
    "codex": {
      "label": "Codex",
      "user": "~/.agents/skills",
      "project": ".agents/skills"
    },
    "opencode": {
      "label": "OpenCode",
      "user": "~/.config/opencode/skills",
      "project": ".opencode/skills"
    },
    "antigravity": {
      "label": "Antigravity",
      "user": "~/.gemini/config/skills",
      "project": ".agents/skills"
    }
  },
  "files": [
    {
      "path": "LICENSE.txt",
      "size": 1059,
      "sha256": "e32449d23085399adc1222f7a17408b730550258e51627c153cb108ca9955823",
      "url": "/raw/github-actions-hardening/LICENSE.txt"
    },
    {
      "path": "references/injection.md",
      "size": 3035,
      "sha256": "ebd6ef8d39ba6f1cd3dc13051e6ed4163d1d2ba36518cf0f7393836a211e58ff",
      "url": "/raw/github-actions-hardening/references/injection.md"
    },
    {
      "path": "references/permissions-and-tokens.md",
      "size": 2743,
      "sha256": "7272d00b20cf99c6fcbf34346f76730907c00701aef44bb9cfb7ab3eecac336b",
      "url": "/raw/github-actions-hardening/references/permissions-and-tokens.md"
    },
    {
      "path": "references/report-format.md",
      "size": 1920,
      "sha256": "3ecd2442e173bc001f858747873349be7c6c77050470b87ae516647908b1e86e",
      "url": "/raw/github-actions-hardening/references/report-format.md"
    },
    {
      "path": "references/supply-chain.md",
      "size": 2938,
      "sha256": "f66f613dbd732ce87c1e76b88208efde8feae3ffe5a3ab405cde4ce3df66f605",
      "url": "/raw/github-actions-hardening/references/supply-chain.md"
    },
    {
      "path": "references/triggers-and-privilege.md",
      "size": 3397,
      "sha256": "465f3f76517e9f5374a73e30f46cb47e1fe62ce9fd81f782808a3abbb2df2756",
      "url": "/raw/github-actions-hardening/references/triggers-and-privilege.md"
    },
    {
      "path": "SKILL.md",
      "size": 9852,
      "sha256": "31a8e7483d978e6267941edefebbe42aaa946bb3d43c9095aa3db343d4a8ff06",
      "url": "/raw/github-actions-hardening/SKILL.md"
    },
    {
      "path": "SOURCE.md",
      "size": 577,
      "sha256": "6052a363ed76603c3a50fd3dc91fdb40100e8bd17aa9f36fc11d6612ccf5e9e3",
      "url": "/raw/github-actions-hardening/SOURCE.md"
    }
  ]
}