Workflow Audit
Workflow Audit systematically reviews `.github/workflows/*.yml` files against security hardening, action version currency, and reliability standards. It discovers all workflow files, validates YAML syntax, runs a comprehensive checklist covering permissions, script injection, timeouts, and cross-workflow consistency, then reports findings sorted by severity with concrete fixes for each issue.
Workflow Audit checks GitHub Actions workflows for security, reliability, and best-practice compliance.
AI-generated summary based on this skill's SKILL.md
Install
xiaolai/vmark/workflow-audit · repository language: TypeScript
git clone https://github.com/xiaolai/vmark
cp -r vmark ~/.claude/skills/workflow-auditgenerated, unverified - the skill's exact subdirectory could not be determined; check the repository on GitHub
npx skillfed install xiaolai/vmark/workflow-auditFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What does Workflow Audit do?
Workflow Audit systematically reviews `.github/workflows/*.yml` files against security hardening, action version currency, and reliability standards. It discovers all workflow files, validates YAML syntax, runs a comprehensive checklist covering permissions, script injection, timeouts, and cross-workflow consistency, then reports findings sorted by severity with concrete fixes for each issue.
Can Workflow Audit track workflow modifications?
Yes. Workflow Audit tracks workflow modifications by discovering all workflow files and validating changes against security and reliability standards. It monitors permissions, script injection risks, timeouts, and cross-workflow consistency to ensure modifications maintain compliance and security posture.
How does Workflow Audit monitor workflow execution?
Workflow Audit monitors workflow execution by reviewing execution logs and activity patterns within `.github/workflows/*.yml` files. It validates YAML syntax, checks action version currency, and ensures timeouts and reliability standards are met across all discovered workflow files.
What audit logs for workflows does Workflow Audit provide?
Workflow Audit provides comprehensive audit logs by validating all workflow files against a checklist covering permissions, script injection, timeouts, and cross-workflow consistency. Findings are reported sorted by severity with concrete fixes for each identified issue.
Can Workflow Audit generate audit reports?
Yes. Workflow Audit generates audit reports by systematically reviewing all discovered workflow files and reporting findings sorted by severity. Each report includes concrete fixes and covers security hardening, action version currency, and reliability standards.
What is the license for Workflow Audit?
Workflow Audit is licensed under the ISC license, which permits free use, modification, and distribution with minimal restrictions.