Last commit on October 27, 2026·Created on January 14, 2026
trailofbits/skills
“Audits GitHub Actions workflows for prompt injection and input vulnerabilities in AI agent integrations.”
Combined rank
#81
across all skills
Stars
8k
+1.8% in last 7d
Forks
682
+1.3% in last 7d
Watchers
65
+1.6% in last 7d
Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
TL;DR
This skill audits CI/CD pipelines to detect attack vectors where attacker-controlled input reaches AI agents. It focuses on identifying risks such as direct expression injection, dangerous sandbox configurations, and insecure environment variable patterns.
Security researchers can use this to evaluate agentic action configurations and protect pipelines from prompt injection risks when using tools like Claude Code Action, Gemini CLI, or OpenAI Codex.
WHO IT'S FOR
Security researchers
performing vulnerability hunting and threat modeling
DevSecOps engineers
auditing CI/CD pipelines for AI agent risks
Smart contract auditors
scanning Algorand and StarkNet contracts for bugs
Blockchain security engineers
reviewing L1-L2 messaging and access control
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Claude
Codex
Gemini CLI
AntigravityWant to install it?
Claude Marketplace · Claude PluginRepository instructions