Workflow Audit
Workflow Audit systematically reviews `.github/workflows/*.yml` files against security hardening, action version currency, and reliability standards. It discovers all workflow files, validates YAML syntax, runs a comprehensive checklist covering permissions, script injection, timeouts, and cross-workflow consistency, then reports findings sorted by severity with concrete fixes for each issue.
Workflow Audit checks GitHub Actions workflows for security, reliability, and best-practice compliance.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-27
Workflow Audit checks GitHub Actions workflows for security, reliability, and best-practice compliance. Workflow Audit systematically reviews `.github/workflows/*.yml` files against security hardening, action version currency, and reliability standards. It discovers all workflow files, validates YAML syntax, runs a comprehensive checklist covering permissions, script injection, timeouts, and cross-workflow consistency, then reports findings sorted by severity with concrete fixes for each issue.
Use it when
- Yes.
- Workflow Audit monitors workflow execution by reviewing execution logs and activity patterns within `.github/workflows/*.yml` files.
Install
xiaolai/vmark/workflow-audit · repository language: TypeScript
generated, unverified - the skill's exact subdirectory could not be determined; check the repository on GitHub
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What does Workflow Audit do?
Workflow Audit systematically reviews `.github/workflows/*.yml` files against security hardening, action version currency, and reliability standards. It discovers all workflow files, validates YAML syntax, runs a comprehensive checklist covering permissions, script injection, timeouts, and cross-workflow consistency, then reports findings sorted by severity with concrete fixes for each issue.
Can Workflow Audit track workflow modifications?
Yes. Workflow Audit tracks workflow modifications by discovering all workflow files and validating changes against security and reliability standards. It monitors permissions, script injection risks, timeouts, and cross-workflow consistency to ensure modifications maintain compliance and security posture.
How does Workflow Audit monitor workflow execution?
Workflow Audit monitors workflow execution by reviewing execution logs and activity patterns within `.github/workflows/*.yml` files. It validates YAML syntax, checks action version currency, and ensures timeouts and reliability standards are met across all discovered workflow files.
What audit logs for workflows does Workflow Audit provide?
Workflow Audit provides comprehensive audit logs by validating all workflow files against a checklist covering permissions, script injection, timeouts, and cross-workflow consistency. Findings are reported sorted by severity with concrete fixes for each identified issue.
Can Workflow Audit generate audit reports?
Yes. Workflow Audit generates audit reports by systematically reviewing all discovered workflow files and reporting findings sorted by severity. Each report includes concrete fixes and covers security hardening, action version currency, and reliability standards.
What is the license for Workflow Audit?
Workflow Audit is licensed under the ISC license, which permits free use, modification, and distribution with minimal restrictions.
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Track and audit workflow execution history and changes”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill guides you through building GitHub Actions workflows with emphasis on security, proper versioning, and avoiding common pitfalls. It covers workflow structure, permissions, events, and recommended actions while highlighting anti-patterns like hardcoded secrets and injection vulnerabilities.
Explore foundational and advanced patterns for building robust continuous integration and deployment workflows. This skill covers architectural approaches, automation strategies, and industry-tested techniques to streamline your development pipeline from code commit through production release.
Claude Agent SDK is Anthropic's framework for building autonomous agents that iteratively use tools to complete tasks. It handles the agent loop, context management, and tool orchestration automatically, with support for custom tools, MCP servers, permissions, and lifecycle hooks. Available in Python and TypeScript.
This skill streamlines GitHub Actions workflow creation by generating or updating CI/CD configurations tailored to your project's needs. Whether you're setting up automated testing, building containers, or deploying applications, it handles the boilerplate and best practices so you can focus on your pipeline logic.
verify is a quality assurance auditor that gates feature work at three checkpoints: proposal readiness, dev doc completeness, and implementation verification. It searches for placeholder content, traceability gaps, missing acceptance criteria, and specification drift, then either passes the gate or blocks with exact findings. Designed to be adversarial—assuming work is incomplete until proven otherwise.
This skill terminates a workflow and creates a new run that replays up to a chosen completed step, then re-executes everything after it. Ideal for iterating on later steps' logic or recovering from failures without re-paying the cost of earlier LLM calls or API requests.
More skills civitai-orchestration (Apache-2.0) · Worktree Pr (NOASSERTION)