Audit advanced Works with: Any AI

GitHub Actions Workflow Security Review (Defensive)

Table output Has example

• 🐙 GitHub

Review a workflow file for risky patterns.

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

Review this GitHub Actions workflow for security and reliability as a defensive review of my own workflow: [WORKFLOW_YAML] with secrets replaced by names. Triggers and who can open pull requests (internal only, forks): [TRIGGER_CONTEXT]. Deployment targets and environments: [DEPLOYMENT_TARGETS].

Check for overly broad token permissions, third-party actions not pinned to a version or commit, pull request triggers that expose secrets to untrusted code, script injection through untrusted inputs such as issue titles or branch names placed directly in shell commands, secrets printed in logs, self-hosted runners with public repositories, missing environment protection for production deployments, caching of sensitive files, and outdated action versions. Be precise about which risks apply given who can trigger the workflow, and say if you need more information.

Explain each risk in plain words and give a corrected snippet. Return a table with Line or step, Risk, Why it matters, Fix and Priority, and a safe test plan on a branch. Mark action versions and syntax [VERIFY against current documentation]. Do not include real secrets.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

Invented findings table. Line 12: permissions not set, so the token has default broad rights; fix: set read-only contents and grant more only where needed. Line 20: a third-party action used by a moving tag; fix: pin to a specific version or commit. Line 34: a pull request title inserted directly into a shell command, which could run unintended text; fix: pass it as an environment variable and quote it. Line 41: a deployment to production without an environment approval; fix: add a protected environment. Priority order: 34, 12, 41, 20. Test the corrected workflow on a branch.

• github