[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-sentry-gha-security-review":3,"mdc--qrhcuf-key":38,"related-org-sentry-gha-security-review":1746,"related-repo-sentry-gha-security-review":1920},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":33,"sourceUrl":36,"mdContent":37},"gha-security-review","review GitHub Actions workflow security","GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to \"review GitHub Actions\", \"audit workflows\", \"check CI security\", \"GHA security\", \"workflow security review\", or review .github\u002Fworkflows\u002F for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"sentry","Sentry","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fsentry.png","getsentry",[13,17,20,23],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"GitHub Actions","github-actions",{"name":21,"slug":22,"type":16},"CI\u002FCD","ci-cd",{"name":24,"slug":25,"type":16},"Code Analysis","code-analysis",861,"https:\u002F\u002Fgithub.com\u002Fgetsentry\u002Fskills","2026-05-15T06:16:26.023538",null,45,[32],"tag-production",{"repoUrl":27,"stars":26,"forks":30,"topics":34,"description":35},[32],"Agent Skills used by the Sentry team for development.","https:\u002F\u002Fgithub.com\u002Fgetsentry\u002Fskills\u002Ftree\u002FHEAD\u002Fskills\u002Fgha-security-review","---\nname: gha-security-review\ndescription: 'GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to \"review GitHub Actions\", \"audit workflows\", \"check CI security\", \"GHA security\", \"workflow security review\", or review .github\u002Fworkflows\u002F for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.'\nallowed-tools: Read, Grep, Glob, Bash, Task\n---\n\n\u003C!--\nAttack patterns and real-world examples sourced from the HackerBot Claw campaign analysis\nby StepSecurity (2025): https:\u002F\u002Fwww.stepsecurity.io\u002Fblog\u002Fhackerbot-claw-github-actions-exploitation\n-->\n\n# GitHub Actions Security Review\n\nFind exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it.\n\nThis skill encodes attack patterns from real GitHub Actions exploits — not generic CI\u002FCD theory.\n\n## Scope\n\nReview the workflows provided (file, diff, or repo). Research the codebase as needed to trace complete attack paths before reporting.\n\n### Files to Review\n\n- `.github\u002Fworkflows\u002F*.yml` — all workflow definitions\n- `action.yml` \u002F `action.yaml` — composite actions in the repo\n- `.github\u002Factions\u002F*\u002Faction.yml` — local reusable actions\n- Config files loaded by workflows: `CLAUDE.md`, `AGENTS.md`, `Makefile`, shell scripts under `.github\u002F`\n\n### Out of Scope\n\n- Workflows in other repositories (only note the dependency)\n- GitHub App installation permissions (note if relevant)\n\n## Threat Model\n\nOnly report vulnerabilities exploitable by an **external attacker** — someone **without** write access to the repository. The attacker can open PRs from forks, create issues, and post comments. They cannot push to branches, trigger `workflow_dispatch`, or trigger manual workflows.\n\n**Do not flag** vulnerabilities that require write access to exploit:\n- `workflow_dispatch` input injection — requires write access to trigger\n- Expression injection in `push`-only workflows on protected branches\n- `workflow_call` input injection where all callers are internal\n- Secrets in `workflow_dispatch`\u002F`schedule`-only workflows\n\n## Confidence\n\nReport only **HIGH** and **MEDIUM** confidence findings. Do not report theoretical issues.\n\n| Confidence | Criteria | Action |\n|---|---|---|\n| **HIGH** | Traced the full attack path, confirmed exploitable | Report with exploitation scenario and fix |\n| **MEDIUM** | Attack path partially confirmed, uncertain link | Report as needs verification |\n| **LOW** | Theoretical or mitigated elsewhere | Do not report |\n\nFor each HIGH finding, provide all five elements:\n\n1. **Entry point** — How does the attacker get in? (fork PR, issue comment, branch name, etc.)\n2. **Payload** — What does the attacker send? (actual code\u002FYAML\u002Finput)\n3. **Execution mechanism** — How does the payload run? (expression expansion, checkout + script, etc.)\n4. **Impact** — What does the attacker gain? (token theft, code execution, repo write access)\n5. **PoC sketch** — Concrete steps an attacker would follow\n\nIf you cannot construct all five, report as MEDIUM (needs verification).\n\n---\n\n## Step 1: Classify Triggers and Load References\n\nFor each workflow, identify triggers and load the appropriate reference:\n\n| Trigger \u002F Pattern | Load Reference |\n|---|---|\n| `pull_request_target` | `references\u002Fpwn-request.md` |\n| `issue_comment` with command parsing | `references\u002Fcomment-triggered-commands.md` |\n| `${{ }}` in `run:` blocks | `references\u002Fexpression-injection.md` |\n| PATs \u002F deploy keys \u002F elevated credentials | `references\u002Fcredential-escalation.md` |\n| Checkout PR code + config file loading | `references\u002Fai-prompt-injection-via-ci.md` |\n| Third-party actions (especially unpinned) | `references\u002Fsupply-chain.md` |\n| `permissions:` block or secrets usage | `references\u002Fpermissions-and-secrets.md` |\n| Self-hosted runners, cache\u002Fartifact usage | `references\u002Frunner-infrastructure.md` |\n| Any confirmed finding | `references\u002Freal-world-attacks.md` |\n\nLoad references selectively — only what's relevant to the triggers found.\n\n## Step 2: Check for Vulnerability Classes\n\n### Check 1: Pwn Request\n\nDoes the workflow use `pull_request_target` AND check out fork code?\n- Look for `actions\u002Fcheckout` with `ref:` pointing to PR head\n- Look for local actions (`.\u002F.github\u002Factions\u002F`) that would come from the fork\n- Check if any `run:` step executes code from the checked-out PR\n\n### Check 2: Expression Injection\n\nAre `${{ }}` expressions used inside `run:` blocks in externally-triggerable workflows?\n- Map every `${{ }}` expression in every `run:` step\n- Confirm the value is attacker-controlled (PR title, branch name, comment body — not numeric IDs, SHAs, or repository names)\n- Confirm the expression is in a `run:` block, not `if:`, `with:`, or job-level `env:`\n\n### Check 3: Unauthorized Command Execution\n\nDoes an `issue_comment`-triggered workflow execute commands without authorization?\n- Is there an `author_association` check?\n- Can any GitHub user trigger the command?\n- Does the command handler also use injectable expressions?\n\n### Check 4: Credential Escalation\n\nAre elevated credentials (PATs, deploy keys) accessible to untrusted code?\n- What's the blast radius of each secret?\n- Could a compromised workflow steal long-lived tokens?\n\n### Check 5: Config File Poisoning\n\nDoes the workflow load configuration from PR-supplied files?\n- AI agent instructions: `CLAUDE.md`, `AGENTS.md`, `.cursorrules`\n- Build configuration: `Makefile`, shell scripts\n\n### Check 6: Supply Chain\n\nAre third-party actions securely pinned?\n\n### Check 7: Permissions and Secrets\n\nAre workflow permissions minimal? Are secrets properly scoped?\n\n### Check 8: Runner Infrastructure\n\nAre self-hosted runners, caches, or artifacts used securely?\n\n## Safe Patterns (Do Not Flag)\n\nBefore reporting, check if the pattern is actually safe:\n\n| Pattern | Why Safe |\n|---|---|\n| `pull_request_target` WITHOUT checkout of fork code | Never executes attacker code |\n| `${{ github.event.pull_request.number }}` in `run:` | Numeric only — not injectable |\n| `${{ github.repository }}` \u002F `github.repository_owner` | Repo owner controls this |\n| `${{ secrets.* }}` | Not an expression injection vector |\n| `${{ }}` in `if:` conditions | Evaluated by Actions runtime, not shell |\n| `${{ }}` in `with:` inputs | Passed as string parameters, not shell-evaluated |\n| Actions pinned to full SHA | Immutable reference |\n| `pull_request` trigger (not `_target`) | Runs in fork context with read-only token |\n| Any expression in `workflow_dispatch`\u002F`schedule`\u002F`push` to protected branches | Requires write access — outside threat model |\n\n**Key distinction:** `${{ }}` is dangerous in `run:` blocks (shell expansion) but safe in `if:`, `with:`, and `env:` at the job\u002Fstep level (Actions runtime evaluation).\n\n## Step 3: Validate Before Reporting\n\nBefore including any finding, read the actual workflow YAML and trace the complete attack path:\n\n1. **Read the full workflow** — don't rely on grep output alone\n2. **Trace the trigger** — confirm the event and check `if:` conditions that gate execution\n3. **Trace the expression\u002Fcheckout** — confirm it's in a `run:` block or actually references fork code\n4. **Confirm attacker control** — verify the value maps to something an external attacker sets\n5. **Check existing mitigations** — env var wrapping, author_association checks, restricted permissions, SHA pinning\n\nIf any link is broken, mark MEDIUM (needs verification) or drop the finding.\n\n**If no checks produced a finding, report zero findings. Do not invent issues.**\n\n## Step 4: Report Findings\n\n````markdown\n## GitHub Actions Security Review\n\n### Findings\n\n#### [GHA-001] [Title] (Severity: Critical\u002FHigh\u002FMedium)\n- **Workflow**: `.github\u002Fworkflows\u002Frelease.yml:15`\n- **Trigger**: `pull_request_target`\n- **Confidence**: HIGH — confirmed through attack path tracing\n- **Exploitation Scenario**:\n  1. [Step-by-step attack]\n- **Impact**: [What attacker gains]\n- **Fix**: [Code that fixes the issue]\n\n### Needs Verification\n[MEDIUM confidence items with explanation of what to verify]\n\n### Reviewed and Cleared\n[Workflows reviewed and confirmed safe]\n````\n\nIf no findings: \"No exploitable vulnerabilities identified. All workflows reviewed and cleared.\"\n",{"data":39,"body":41},{"name":4,"description":6,"allowed-tools":40},"Read, Grep, Glob, Bash, Task",{"type":42,"children":43},"root",[44,53,59,64,71,76,83,164,170,183,189,217,227,284,290,309,402,407,461,466,470,476,481,686,691,697,703,715,764,770,789,849,855,867,893,899,904,917,923,928,966,972,977,983,988,994,999,1005,1010,1234,1278,1284,1289,1356,1361,1369,1375,1735,1740],{"type":45,"tag":46,"props":47,"children":49},"element","h1",{"id":48},"github-actions-security-review",[50],{"type":51,"value":52},"text","GitHub Actions Security Review",{"type":45,"tag":54,"props":55,"children":56},"p",{},[57],{"type":51,"value":58},"Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it.",{"type":45,"tag":54,"props":60,"children":61},{},[62],{"type":51,"value":63},"This skill encodes attack patterns from real GitHub Actions exploits — not generic CI\u002FCD theory.",{"type":45,"tag":65,"props":66,"children":68},"h2",{"id":67},"scope",[69],{"type":51,"value":70},"Scope",{"type":45,"tag":54,"props":72,"children":73},{},[74],{"type":51,"value":75},"Review the workflows provided (file, diff, or repo). Research the codebase as needed to trace complete attack paths before reporting.",{"type":45,"tag":77,"props":78,"children":80},"h3",{"id":79},"files-to-review",[81],{"type":51,"value":82},"Files to Review",{"type":45,"tag":84,"props":85,"children":86},"ul",{},[87,100,119,130],{"type":45,"tag":88,"props":89,"children":90},"li",{},[91,98],{"type":45,"tag":92,"props":93,"children":95},"code",{"className":94},[],[96],{"type":51,"value":97},".github\u002Fworkflows\u002F*.yml",{"type":51,"value":99}," — all workflow definitions",{"type":45,"tag":88,"props":101,"children":102},{},[103,109,111,117],{"type":45,"tag":92,"props":104,"children":106},{"className":105},[],[107],{"type":51,"value":108},"action.yml",{"type":51,"value":110}," \u002F ",{"type":45,"tag":92,"props":112,"children":114},{"className":113},[],[115],{"type":51,"value":116},"action.yaml",{"type":51,"value":118}," — composite actions in the repo",{"type":45,"tag":88,"props":120,"children":121},{},[122,128],{"type":45,"tag":92,"props":123,"children":125},{"className":124},[],[126],{"type":51,"value":127},".github\u002Factions\u002F*\u002Faction.yml",{"type":51,"value":129}," — local reusable actions",{"type":45,"tag":88,"props":131,"children":132},{},[133,135,141,143,149,150,156,158],{"type":51,"value":134},"Config files loaded by workflows: ",{"type":45,"tag":92,"props":136,"children":138},{"className":137},[],[139],{"type":51,"value":140},"CLAUDE.md",{"type":51,"value":142},", ",{"type":45,"tag":92,"props":144,"children":146},{"className":145},[],[147],{"type":51,"value":148},"AGENTS.md",{"type":51,"value":142},{"type":45,"tag":92,"props":151,"children":153},{"className":152},[],[154],{"type":51,"value":155},"Makefile",{"type":51,"value":157},", shell scripts under ",{"type":45,"tag":92,"props":159,"children":161},{"className":160},[],[162],{"type":51,"value":163},".github\u002F",{"type":45,"tag":77,"props":165,"children":167},{"id":166},"out-of-scope",[168],{"type":51,"value":169},"Out of Scope",{"type":45,"tag":84,"props":171,"children":172},{},[173,178],{"type":45,"tag":88,"props":174,"children":175},{},[176],{"type":51,"value":177},"Workflows in other repositories (only note the dependency)",{"type":45,"tag":88,"props":179,"children":180},{},[181],{"type":51,"value":182},"GitHub App installation permissions (note if relevant)",{"type":45,"tag":65,"props":184,"children":186},{"id":185},"threat-model",[187],{"type":51,"value":188},"Threat Model",{"type":45,"tag":54,"props":190,"children":191},{},[192,194,200,202,207,209,215],{"type":51,"value":193},"Only report vulnerabilities exploitable by an ",{"type":45,"tag":195,"props":196,"children":197},"strong",{},[198],{"type":51,"value":199},"external attacker",{"type":51,"value":201}," — someone ",{"type":45,"tag":195,"props":203,"children":204},{},[205],{"type":51,"value":206},"without",{"type":51,"value":208}," write access to the repository. The attacker can open PRs from forks, create issues, and post comments. They cannot push to branches, trigger ",{"type":45,"tag":92,"props":210,"children":212},{"className":211},[],[213],{"type":51,"value":214},"workflow_dispatch",{"type":51,"value":216},", or trigger manual workflows.",{"type":45,"tag":54,"props":218,"children":219},{},[220,225],{"type":45,"tag":195,"props":221,"children":222},{},[223],{"type":51,"value":224},"Do not flag",{"type":51,"value":226}," vulnerabilities that require write access to exploit:",{"type":45,"tag":84,"props":228,"children":229},{},[230,240,253,264],{"type":45,"tag":88,"props":231,"children":232},{},[233,238],{"type":45,"tag":92,"props":234,"children":236},{"className":235},[],[237],{"type":51,"value":214},{"type":51,"value":239}," input injection — requires write access to trigger",{"type":45,"tag":88,"props":241,"children":242},{},[243,245,251],{"type":51,"value":244},"Expression injection in ",{"type":45,"tag":92,"props":246,"children":248},{"className":247},[],[249],{"type":51,"value":250},"push",{"type":51,"value":252},"-only workflows on protected branches",{"type":45,"tag":88,"props":254,"children":255},{},[256,262],{"type":45,"tag":92,"props":257,"children":259},{"className":258},[],[260],{"type":51,"value":261},"workflow_call",{"type":51,"value":263}," input injection where all callers are internal",{"type":45,"tag":88,"props":265,"children":266},{},[267,269,274,276,282],{"type":51,"value":268},"Secrets in ",{"type":45,"tag":92,"props":270,"children":272},{"className":271},[],[273],{"type":51,"value":214},{"type":51,"value":275},"\u002F",{"type":45,"tag":92,"props":277,"children":279},{"className":278},[],[280],{"type":51,"value":281},"schedule",{"type":51,"value":283},"-only workflows",{"type":45,"tag":65,"props":285,"children":287},{"id":286},"confidence",[288],{"type":51,"value":289},"Confidence",{"type":45,"tag":54,"props":291,"children":292},{},[293,295,300,302,307],{"type":51,"value":294},"Report only ",{"type":45,"tag":195,"props":296,"children":297},{},[298],{"type":51,"value":299},"HIGH",{"type":51,"value":301}," and ",{"type":45,"tag":195,"props":303,"children":304},{},[305],{"type":51,"value":306},"MEDIUM",{"type":51,"value":308}," confidence findings. Do not report theoretical issues.",{"type":45,"tag":310,"props":311,"children":312},"table",{},[313,336],{"type":45,"tag":314,"props":315,"children":316},"thead",{},[317],{"type":45,"tag":318,"props":319,"children":320},"tr",{},[321,326,331],{"type":45,"tag":322,"props":323,"children":324},"th",{},[325],{"type":51,"value":289},{"type":45,"tag":322,"props":327,"children":328},{},[329],{"type":51,"value":330},"Criteria",{"type":45,"tag":322,"props":332,"children":333},{},[334],{"type":51,"value":335},"Action",{"type":45,"tag":337,"props":338,"children":339},"tbody",{},[340,361,381],{"type":45,"tag":318,"props":341,"children":342},{},[343,351,356],{"type":45,"tag":344,"props":345,"children":346},"td",{},[347],{"type":45,"tag":195,"props":348,"children":349},{},[350],{"type":51,"value":299},{"type":45,"tag":344,"props":352,"children":353},{},[354],{"type":51,"value":355},"Traced the full attack path, confirmed exploitable",{"type":45,"tag":344,"props":357,"children":358},{},[359],{"type":51,"value":360},"Report with exploitation scenario and fix",{"type":45,"tag":318,"props":362,"children":363},{},[364,371,376],{"type":45,"tag":344,"props":365,"children":366},{},[367],{"type":45,"tag":195,"props":368,"children":369},{},[370],{"type":51,"value":306},{"type":45,"tag":344,"props":372,"children":373},{},[374],{"type":51,"value":375},"Attack path partially confirmed, uncertain link",{"type":45,"tag":344,"props":377,"children":378},{},[379],{"type":51,"value":380},"Report as needs verification",{"type":45,"tag":318,"props":382,"children":383},{},[384,392,397],{"type":45,"tag":344,"props":385,"children":386},{},[387],{"type":45,"tag":195,"props":388,"children":389},{},[390],{"type":51,"value":391},"LOW",{"type":45,"tag":344,"props":393,"children":394},{},[395],{"type":51,"value":396},"Theoretical or mitigated elsewhere",{"type":45,"tag":344,"props":398,"children":399},{},[400],{"type":51,"value":401},"Do not report",{"type":45,"tag":54,"props":403,"children":404},{},[405],{"type":51,"value":406},"For each HIGH finding, provide all five elements:",{"type":45,"tag":408,"props":409,"children":410},"ol",{},[411,421,431,441,451],{"type":45,"tag":88,"props":412,"children":413},{},[414,419],{"type":45,"tag":195,"props":415,"children":416},{},[417],{"type":51,"value":418},"Entry point",{"type":51,"value":420}," — How does the attacker get in? (fork PR, issue comment, branch name, etc.)",{"type":45,"tag":88,"props":422,"children":423},{},[424,429],{"type":45,"tag":195,"props":425,"children":426},{},[427],{"type":51,"value":428},"Payload",{"type":51,"value":430}," — What does the attacker send? (actual code\u002FYAML\u002Finput)",{"type":45,"tag":88,"props":432,"children":433},{},[434,439],{"type":45,"tag":195,"props":435,"children":436},{},[437],{"type":51,"value":438},"Execution mechanism",{"type":51,"value":440}," — How does the payload run? (expression expansion, checkout + script, etc.)",{"type":45,"tag":88,"props":442,"children":443},{},[444,449],{"type":45,"tag":195,"props":445,"children":446},{},[447],{"type":51,"value":448},"Impact",{"type":51,"value":450}," — What does the attacker gain? (token theft, code execution, repo write access)",{"type":45,"tag":88,"props":452,"children":453},{},[454,459],{"type":45,"tag":195,"props":455,"children":456},{},[457],{"type":51,"value":458},"PoC sketch",{"type":51,"value":460}," — Concrete steps an attacker would follow",{"type":45,"tag":54,"props":462,"children":463},{},[464],{"type":51,"value":465},"If you cannot construct all five, report as MEDIUM (needs verification).",{"type":45,"tag":467,"props":468,"children":469},"hr",{},[],{"type":45,"tag":65,"props":471,"children":473},{"id":472},"step-1-classify-triggers-and-load-references",[474],{"type":51,"value":475},"Step 1: Classify Triggers and Load References",{"type":45,"tag":54,"props":477,"children":478},{},[479],{"type":51,"value":480},"For each workflow, identify triggers and load the appropriate reference:",{"type":45,"tag":310,"props":482,"children":483},{},[484,500],{"type":45,"tag":314,"props":485,"children":486},{},[487],{"type":45,"tag":318,"props":488,"children":489},{},[490,495],{"type":45,"tag":322,"props":491,"children":492},{},[493],{"type":51,"value":494},"Trigger \u002F Pattern",{"type":45,"tag":322,"props":496,"children":497},{},[498],{"type":51,"value":499},"Load Reference",{"type":45,"tag":337,"props":501,"children":502},{},[503,524,547,578,595,612,629,652,669],{"type":45,"tag":318,"props":504,"children":505},{},[506,515],{"type":45,"tag":344,"props":507,"children":508},{},[509],{"type":45,"tag":92,"props":510,"children":512},{"className":511},[],[513],{"type":51,"value":514},"pull_request_target",{"type":45,"tag":344,"props":516,"children":517},{},[518],{"type":45,"tag":92,"props":519,"children":521},{"className":520},[],[522],{"type":51,"value":523},"references\u002Fpwn-request.md",{"type":45,"tag":318,"props":525,"children":526},{},[527,538],{"type":45,"tag":344,"props":528,"children":529},{},[530,536],{"type":45,"tag":92,"props":531,"children":533},{"className":532},[],[534],{"type":51,"value":535},"issue_comment",{"type":51,"value":537}," with command parsing",{"type":45,"tag":344,"props":539,"children":540},{},[541],{"type":45,"tag":92,"props":542,"children":544},{"className":543},[],[545],{"type":51,"value":546},"references\u002Fcomment-triggered-commands.md",{"type":45,"tag":318,"props":548,"children":549},{},[550,569],{"type":45,"tag":344,"props":551,"children":552},{},[553,559,561,567],{"type":45,"tag":92,"props":554,"children":556},{"className":555},[],[557],{"type":51,"value":558},"${{ }}",{"type":51,"value":560}," in ",{"type":45,"tag":92,"props":562,"children":564},{"className":563},[],[565],{"type":51,"value":566},"run:",{"type":51,"value":568}," blocks",{"type":45,"tag":344,"props":570,"children":571},{},[572],{"type":45,"tag":92,"props":573,"children":575},{"className":574},[],[576],{"type":51,"value":577},"references\u002Fexpression-injection.md",{"type":45,"tag":318,"props":579,"children":580},{},[581,586],{"type":45,"tag":344,"props":582,"children":583},{},[584],{"type":51,"value":585},"PATs \u002F deploy keys \u002F elevated credentials",{"type":45,"tag":344,"props":587,"children":588},{},[589],{"type":45,"tag":92,"props":590,"children":592},{"className":591},[],[593],{"type":51,"value":594},"references\u002Fcredential-escalation.md",{"type":45,"tag":318,"props":596,"children":597},{},[598,603],{"type":45,"tag":344,"props":599,"children":600},{},[601],{"type":51,"value":602},"Checkout PR code + config file loading",{"type":45,"tag":344,"props":604,"children":605},{},[606],{"type":45,"tag":92,"props":607,"children":609},{"className":608},[],[610],{"type":51,"value":611},"references\u002Fai-prompt-injection-via-ci.md",{"type":45,"tag":318,"props":613,"children":614},{},[615,620],{"type":45,"tag":344,"props":616,"children":617},{},[618],{"type":51,"value":619},"Third-party actions (especially unpinned)",{"type":45,"tag":344,"props":621,"children":622},{},[623],{"type":45,"tag":92,"props":624,"children":626},{"className":625},[],[627],{"type":51,"value":628},"references\u002Fsupply-chain.md",{"type":45,"tag":318,"props":630,"children":631},{},[632,643],{"type":45,"tag":344,"props":633,"children":634},{},[635,641],{"type":45,"tag":92,"props":636,"children":638},{"className":637},[],[639],{"type":51,"value":640},"permissions:",{"type":51,"value":642}," block or secrets usage",{"type":45,"tag":344,"props":644,"children":645},{},[646],{"type":45,"tag":92,"props":647,"children":649},{"className":648},[],[650],{"type":51,"value":651},"references\u002Fpermissions-and-secrets.md",{"type":45,"tag":318,"props":653,"children":654},{},[655,660],{"type":45,"tag":344,"props":656,"children":657},{},[658],{"type":51,"value":659},"Self-hosted runners, cache\u002Fartifact usage",{"type":45,"tag":344,"props":661,"children":662},{},[663],{"type":45,"tag":92,"props":664,"children":666},{"className":665},[],[667],{"type":51,"value":668},"references\u002Frunner-infrastructure.md",{"type":45,"tag":318,"props":670,"children":671},{},[672,677],{"type":45,"tag":344,"props":673,"children":674},{},[675],{"type":51,"value":676},"Any confirmed finding",{"type":45,"tag":344,"props":678,"children":679},{},[680],{"type":45,"tag":92,"props":681,"children":683},{"className":682},[],[684],{"type":51,"value":685},"references\u002Freal-world-attacks.md",{"type":45,"tag":54,"props":687,"children":688},{},[689],{"type":51,"value":690},"Load references selectively — only what's relevant to the triggers found.",{"type":45,"tag":65,"props":692,"children":694},{"id":693},"step-2-check-for-vulnerability-classes",[695],{"type":51,"value":696},"Step 2: Check for Vulnerability Classes",{"type":45,"tag":77,"props":698,"children":700},{"id":699},"check-1-pwn-request",[701],{"type":51,"value":702},"Check 1: Pwn Request",{"type":45,"tag":54,"props":704,"children":705},{},[706,708,713],{"type":51,"value":707},"Does the workflow use ",{"type":45,"tag":92,"props":709,"children":711},{"className":710},[],[712],{"type":51,"value":514},{"type":51,"value":714}," AND check out fork code?",{"type":45,"tag":84,"props":716,"children":717},{},[718,739,752],{"type":45,"tag":88,"props":719,"children":720},{},[721,723,729,731,737],{"type":51,"value":722},"Look for ",{"type":45,"tag":92,"props":724,"children":726},{"className":725},[],[727],{"type":51,"value":728},"actions\u002Fcheckout",{"type":51,"value":730}," with ",{"type":45,"tag":92,"props":732,"children":734},{"className":733},[],[735],{"type":51,"value":736},"ref:",{"type":51,"value":738}," pointing to PR head",{"type":45,"tag":88,"props":740,"children":741},{},[742,744,750],{"type":51,"value":743},"Look for local actions (",{"type":45,"tag":92,"props":745,"children":747},{"className":746},[],[748],{"type":51,"value":749},".\u002F.github\u002Factions\u002F",{"type":51,"value":751},") that would come from the fork",{"type":45,"tag":88,"props":753,"children":754},{},[755,757,762],{"type":51,"value":756},"Check if any ",{"type":45,"tag":92,"props":758,"children":760},{"className":759},[],[761],{"type":51,"value":566},{"type":51,"value":763}," step executes code from the checked-out PR",{"type":45,"tag":77,"props":765,"children":767},{"id":766},"check-2-expression-injection",[768],{"type":51,"value":769},"Check 2: Expression Injection",{"type":45,"tag":54,"props":771,"children":772},{},[773,775,780,782,787],{"type":51,"value":774},"Are ",{"type":45,"tag":92,"props":776,"children":778},{"className":777},[],[779],{"type":51,"value":558},{"type":51,"value":781}," expressions used inside ",{"type":45,"tag":92,"props":783,"children":785},{"className":784},[],[786],{"type":51,"value":566},{"type":51,"value":788}," blocks in externally-triggerable workflows?",{"type":45,"tag":84,"props":790,"children":791},{},[792,811,816],{"type":45,"tag":88,"props":793,"children":794},{},[795,797,802,804,809],{"type":51,"value":796},"Map every ",{"type":45,"tag":92,"props":798,"children":800},{"className":799},[],[801],{"type":51,"value":558},{"type":51,"value":803}," expression in every ",{"type":45,"tag":92,"props":805,"children":807},{"className":806},[],[808],{"type":51,"value":566},{"type":51,"value":810}," step",{"type":45,"tag":88,"props":812,"children":813},{},[814],{"type":51,"value":815},"Confirm the value is attacker-controlled (PR title, branch name, comment body — not numeric IDs, SHAs, or repository names)",{"type":45,"tag":88,"props":817,"children":818},{},[819,821,826,828,834,835,841,843],{"type":51,"value":820},"Confirm the expression is in a ",{"type":45,"tag":92,"props":822,"children":824},{"className":823},[],[825],{"type":51,"value":566},{"type":51,"value":827}," block, not ",{"type":45,"tag":92,"props":829,"children":831},{"className":830},[],[832],{"type":51,"value":833},"if:",{"type":51,"value":142},{"type":45,"tag":92,"props":836,"children":838},{"className":837},[],[839],{"type":51,"value":840},"with:",{"type":51,"value":842},", or job-level ",{"type":45,"tag":92,"props":844,"children":846},{"className":845},[],[847],{"type":51,"value":848},"env:",{"type":45,"tag":77,"props":850,"children":852},{"id":851},"check-3-unauthorized-command-execution",[853],{"type":51,"value":854},"Check 3: Unauthorized Command Execution",{"type":45,"tag":54,"props":856,"children":857},{},[858,860,865],{"type":51,"value":859},"Does an ",{"type":45,"tag":92,"props":861,"children":863},{"className":862},[],[864],{"type":51,"value":535},{"type":51,"value":866},"-triggered workflow execute commands without authorization?",{"type":45,"tag":84,"props":868,"children":869},{},[870,883,888],{"type":45,"tag":88,"props":871,"children":872},{},[873,875,881],{"type":51,"value":874},"Is there an ",{"type":45,"tag":92,"props":876,"children":878},{"className":877},[],[879],{"type":51,"value":880},"author_association",{"type":51,"value":882}," check?",{"type":45,"tag":88,"props":884,"children":885},{},[886],{"type":51,"value":887},"Can any GitHub user trigger the command?",{"type":45,"tag":88,"props":889,"children":890},{},[891],{"type":51,"value":892},"Does the command handler also use injectable expressions?",{"type":45,"tag":77,"props":894,"children":896},{"id":895},"check-4-credential-escalation",[897],{"type":51,"value":898},"Check 4: Credential Escalation",{"type":45,"tag":54,"props":900,"children":901},{},[902],{"type":51,"value":903},"Are elevated credentials (PATs, deploy keys) accessible to untrusted code?",{"type":45,"tag":84,"props":905,"children":906},{},[907,912],{"type":45,"tag":88,"props":908,"children":909},{},[910],{"type":51,"value":911},"What's the blast radius of each secret?",{"type":45,"tag":88,"props":913,"children":914},{},[915],{"type":51,"value":916},"Could a compromised workflow steal long-lived tokens?",{"type":45,"tag":77,"props":918,"children":920},{"id":919},"check-5-config-file-poisoning",[921],{"type":51,"value":922},"Check 5: Config File Poisoning",{"type":45,"tag":54,"props":924,"children":925},{},[926],{"type":51,"value":927},"Does the workflow load configuration from PR-supplied files?",{"type":45,"tag":84,"props":929,"children":930},{},[931,954],{"type":45,"tag":88,"props":932,"children":933},{},[934,936,941,942,947,948],{"type":51,"value":935},"AI agent instructions: ",{"type":45,"tag":92,"props":937,"children":939},{"className":938},[],[940],{"type":51,"value":140},{"type":51,"value":142},{"type":45,"tag":92,"props":943,"children":945},{"className":944},[],[946],{"type":51,"value":148},{"type":51,"value":142},{"type":45,"tag":92,"props":949,"children":951},{"className":950},[],[952],{"type":51,"value":953},".cursorrules",{"type":45,"tag":88,"props":955,"children":956},{},[957,959,964],{"type":51,"value":958},"Build configuration: ",{"type":45,"tag":92,"props":960,"children":962},{"className":961},[],[963],{"type":51,"value":155},{"type":51,"value":965},", shell scripts",{"type":45,"tag":77,"props":967,"children":969},{"id":968},"check-6-supply-chain",[970],{"type":51,"value":971},"Check 6: Supply Chain",{"type":45,"tag":54,"props":973,"children":974},{},[975],{"type":51,"value":976},"Are third-party actions securely pinned?",{"type":45,"tag":77,"props":978,"children":980},{"id":979},"check-7-permissions-and-secrets",[981],{"type":51,"value":982},"Check 7: Permissions and Secrets",{"type":45,"tag":54,"props":984,"children":985},{},[986],{"type":51,"value":987},"Are workflow permissions minimal? Are secrets properly scoped?",{"type":45,"tag":77,"props":989,"children":991},{"id":990},"check-8-runner-infrastructure",[992],{"type":51,"value":993},"Check 8: Runner Infrastructure",{"type":45,"tag":54,"props":995,"children":996},{},[997],{"type":51,"value":998},"Are self-hosted runners, caches, or artifacts used securely?",{"type":45,"tag":65,"props":1000,"children":1002},{"id":1001},"safe-patterns-do-not-flag",[1003],{"type":51,"value":1004},"Safe Patterns (Do Not Flag)",{"type":45,"tag":54,"props":1006,"children":1007},{},[1008],{"type":51,"value":1009},"Before reporting, check if the pattern is actually safe:",{"type":45,"tag":310,"props":1011,"children":1012},{},[1013,1029],{"type":45,"tag":314,"props":1014,"children":1015},{},[1016],{"type":45,"tag":318,"props":1017,"children":1018},{},[1019,1024],{"type":45,"tag":322,"props":1020,"children":1021},{},[1022],{"type":51,"value":1023},"Pattern",{"type":45,"tag":322,"props":1025,"children":1026},{},[1027],{"type":51,"value":1028},"Why Safe",{"type":45,"tag":337,"props":1030,"children":1031},{},[1032,1050,1073,1097,1114,1138,1162,1175,1202],{"type":45,"tag":318,"props":1033,"children":1034},{},[1035,1045],{"type":45,"tag":344,"props":1036,"children":1037},{},[1038,1043],{"type":45,"tag":92,"props":1039,"children":1041},{"className":1040},[],[1042],{"type":51,"value":514},{"type":51,"value":1044}," WITHOUT checkout of fork code",{"type":45,"tag":344,"props":1046,"children":1047},{},[1048],{"type":51,"value":1049},"Never executes attacker code",{"type":45,"tag":318,"props":1051,"children":1052},{},[1053,1068],{"type":45,"tag":344,"props":1054,"children":1055},{},[1056,1062,1063],{"type":45,"tag":92,"props":1057,"children":1059},{"className":1058},[],[1060],{"type":51,"value":1061},"${{ github.event.pull_request.number }}",{"type":51,"value":560},{"type":45,"tag":92,"props":1064,"children":1066},{"className":1065},[],[1067],{"type":51,"value":566},{"type":45,"tag":344,"props":1069,"children":1070},{},[1071],{"type":51,"value":1072},"Numeric only — not injectable",{"type":45,"tag":318,"props":1074,"children":1075},{},[1076,1092],{"type":45,"tag":344,"props":1077,"children":1078},{},[1079,1085,1086],{"type":45,"tag":92,"props":1080,"children":1082},{"className":1081},[],[1083],{"type":51,"value":1084},"${{ github.repository }}",{"type":51,"value":110},{"type":45,"tag":92,"props":1087,"children":1089},{"className":1088},[],[1090],{"type":51,"value":1091},"github.repository_owner",{"type":45,"tag":344,"props":1093,"children":1094},{},[1095],{"type":51,"value":1096},"Repo owner controls this",{"type":45,"tag":318,"props":1098,"children":1099},{},[1100,1109],{"type":45,"tag":344,"props":1101,"children":1102},{},[1103],{"type":45,"tag":92,"props":1104,"children":1106},{"className":1105},[],[1107],{"type":51,"value":1108},"${{ secrets.* }}",{"type":45,"tag":344,"props":1110,"children":1111},{},[1112],{"type":51,"value":1113},"Not an expression injection vector",{"type":45,"tag":318,"props":1115,"children":1116},{},[1117,1133],{"type":45,"tag":344,"props":1118,"children":1119},{},[1120,1125,1126,1131],{"type":45,"tag":92,"props":1121,"children":1123},{"className":1122},[],[1124],{"type":51,"value":558},{"type":51,"value":560},{"type":45,"tag":92,"props":1127,"children":1129},{"className":1128},[],[1130],{"type":51,"value":833},{"type":51,"value":1132}," conditions",{"type":45,"tag":344,"props":1134,"children":1135},{},[1136],{"type":51,"value":1137},"Evaluated by Actions runtime, not shell",{"type":45,"tag":318,"props":1139,"children":1140},{},[1141,1157],{"type":45,"tag":344,"props":1142,"children":1143},{},[1144,1149,1150,1155],{"type":45,"tag":92,"props":1145,"children":1147},{"className":1146},[],[1148],{"type":51,"value":558},{"type":51,"value":560},{"type":45,"tag":92,"props":1151,"children":1153},{"className":1152},[],[1154],{"type":51,"value":840},{"type":51,"value":1156}," inputs",{"type":45,"tag":344,"props":1158,"children":1159},{},[1160],{"type":51,"value":1161},"Passed as string parameters, not shell-evaluated",{"type":45,"tag":318,"props":1163,"children":1164},{},[1165,1170],{"type":45,"tag":344,"props":1166,"children":1167},{},[1168],{"type":51,"value":1169},"Actions pinned to full SHA",{"type":45,"tag":344,"props":1171,"children":1172},{},[1173],{"type":51,"value":1174},"Immutable reference",{"type":45,"tag":318,"props":1176,"children":1177},{},[1178,1197],{"type":45,"tag":344,"props":1179,"children":1180},{},[1181,1187,1189,1195],{"type":45,"tag":92,"props":1182,"children":1184},{"className":1183},[],[1185],{"type":51,"value":1186},"pull_request",{"type":51,"value":1188}," trigger (not ",{"type":45,"tag":92,"props":1190,"children":1192},{"className":1191},[],[1193],{"type":51,"value":1194},"_target",{"type":51,"value":1196},")",{"type":45,"tag":344,"props":1198,"children":1199},{},[1200],{"type":51,"value":1201},"Runs in fork context with read-only token",{"type":45,"tag":318,"props":1203,"children":1204},{},[1205,1229],{"type":45,"tag":344,"props":1206,"children":1207},{},[1208,1210,1215,1216,1221,1222,1227],{"type":51,"value":1209},"Any expression in ",{"type":45,"tag":92,"props":1211,"children":1213},{"className":1212},[],[1214],{"type":51,"value":214},{"type":51,"value":275},{"type":45,"tag":92,"props":1217,"children":1219},{"className":1218},[],[1220],{"type":51,"value":281},{"type":51,"value":275},{"type":45,"tag":92,"props":1223,"children":1225},{"className":1224},[],[1226],{"type":51,"value":250},{"type":51,"value":1228}," to protected branches",{"type":45,"tag":344,"props":1230,"children":1231},{},[1232],{"type":51,"value":1233},"Requires write access — outside threat model",{"type":45,"tag":54,"props":1235,"children":1236},{},[1237,1242,1244,1249,1251,1256,1258,1263,1264,1269,1271,1276],{"type":45,"tag":195,"props":1238,"children":1239},{},[1240],{"type":51,"value":1241},"Key distinction:",{"type":51,"value":1243}," ",{"type":45,"tag":92,"props":1245,"children":1247},{"className":1246},[],[1248],{"type":51,"value":558},{"type":51,"value":1250}," is dangerous in ",{"type":45,"tag":92,"props":1252,"children":1254},{"className":1253},[],[1255],{"type":51,"value":566},{"type":51,"value":1257}," blocks (shell expansion) but safe in ",{"type":45,"tag":92,"props":1259,"children":1261},{"className":1260},[],[1262],{"type":51,"value":833},{"type":51,"value":142},{"type":45,"tag":92,"props":1265,"children":1267},{"className":1266},[],[1268],{"type":51,"value":840},{"type":51,"value":1270},", and ",{"type":45,"tag":92,"props":1272,"children":1274},{"className":1273},[],[1275],{"type":51,"value":848},{"type":51,"value":1277}," at the job\u002Fstep level (Actions runtime evaluation).",{"type":45,"tag":65,"props":1279,"children":1281},{"id":1280},"step-3-validate-before-reporting",[1282],{"type":51,"value":1283},"Step 3: Validate Before Reporting",{"type":45,"tag":54,"props":1285,"children":1286},{},[1287],{"type":51,"value":1288},"Before including any finding, read the actual workflow YAML and trace the complete attack path:",{"type":45,"tag":408,"props":1290,"children":1291},{},[1292,1302,1319,1336,1346],{"type":45,"tag":88,"props":1293,"children":1294},{},[1295,1300],{"type":45,"tag":195,"props":1296,"children":1297},{},[1298],{"type":51,"value":1299},"Read the full workflow",{"type":51,"value":1301}," — don't rely on grep output alone",{"type":45,"tag":88,"props":1303,"children":1304},{},[1305,1310,1312,1317],{"type":45,"tag":195,"props":1306,"children":1307},{},[1308],{"type":51,"value":1309},"Trace the trigger",{"type":51,"value":1311}," — confirm the event and check ",{"type":45,"tag":92,"props":1313,"children":1315},{"className":1314},[],[1316],{"type":51,"value":833},{"type":51,"value":1318}," conditions that gate execution",{"type":45,"tag":88,"props":1320,"children":1321},{},[1322,1327,1329,1334],{"type":45,"tag":195,"props":1323,"children":1324},{},[1325],{"type":51,"value":1326},"Trace the expression\u002Fcheckout",{"type":51,"value":1328}," — confirm it's in a ",{"type":45,"tag":92,"props":1330,"children":1332},{"className":1331},[],[1333],{"type":51,"value":566},{"type":51,"value":1335}," block or actually references fork code",{"type":45,"tag":88,"props":1337,"children":1338},{},[1339,1344],{"type":45,"tag":195,"props":1340,"children":1341},{},[1342],{"type":51,"value":1343},"Confirm attacker control",{"type":51,"value":1345}," — verify the value maps to something an external attacker sets",{"type":45,"tag":88,"props":1347,"children":1348},{},[1349,1354],{"type":45,"tag":195,"props":1350,"children":1351},{},[1352],{"type":51,"value":1353},"Check existing mitigations",{"type":51,"value":1355}," — env var wrapping, author_association checks, restricted permissions, SHA pinning",{"type":45,"tag":54,"props":1357,"children":1358},{},[1359],{"type":51,"value":1360},"If any link is broken, mark MEDIUM (needs verification) or drop the finding.",{"type":45,"tag":54,"props":1362,"children":1363},{},[1364],{"type":45,"tag":195,"props":1365,"children":1366},{},[1367],{"type":51,"value":1368},"If no checks produced a finding, report zero findings. Do not invent issues.",{"type":45,"tag":65,"props":1370,"children":1372},{"id":1371},"step-4-report-findings",[1373],{"type":51,"value":1374},"Step 4: Report Findings",{"type":45,"tag":1376,"props":1377,"children":1382},"pre",{"className":1378,"code":1379,"language":1380,"meta":1381,"style":1381},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","## GitHub Actions Security Review\n\n### Findings\n\n#### [GHA-001] [Title] (Severity: Critical\u002FHigh\u002FMedium)\n- **Workflow**: `.github\u002Fworkflows\u002Frelease.yml:15`\n- **Trigger**: `pull_request_target`\n- **Confidence**: HIGH — confirmed through attack path tracing\n- **Exploitation Scenario**:\n  1. [Step-by-step attack]\n- **Impact**: [What attacker gains]\n- **Fix**: [Code that fixes the issue]\n\n### Needs Verification\n[MEDIUM confidence items with explanation of what to verify]\n\n### Reviewed and Cleared\n[Workflows reviewed and confirmed safe]\n","markdown","",[1383],{"type":45,"tag":92,"props":1384,"children":1385},{"__ignoreMap":1381},[1386,1404,1414,1428,1436,1475,1522,1559,1584,1610,1624,1649,1675,1683,1696,1705,1713,1726],{"type":45,"tag":1387,"props":1388,"children":1391},"span",{"class":1389,"line":1390},"line",1,[1392,1398],{"type":45,"tag":1387,"props":1393,"children":1395},{"style":1394},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1396],{"type":51,"value":1397},"## ",{"type":45,"tag":1387,"props":1399,"children":1401},{"style":1400},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1402],{"type":51,"value":1403},"GitHub Actions Security Review\n",{"type":45,"tag":1387,"props":1405,"children":1407},{"class":1389,"line":1406},2,[1408],{"type":45,"tag":1387,"props":1409,"children":1411},{"emptyLinePlaceholder":1410},true,[1412],{"type":51,"value":1413},"\n",{"type":45,"tag":1387,"props":1415,"children":1417},{"class":1389,"line":1416},3,[1418,1423],{"type":45,"tag":1387,"props":1419,"children":1420},{"style":1394},[1421],{"type":51,"value":1422},"### ",{"type":45,"tag":1387,"props":1424,"children":1425},{"style":1400},[1426],{"type":51,"value":1427},"Findings\n",{"type":45,"tag":1387,"props":1429,"children":1431},{"class":1389,"line":1430},4,[1432],{"type":45,"tag":1387,"props":1433,"children":1434},{"emptyLinePlaceholder":1410},[1435],{"type":51,"value":1413},{"type":45,"tag":1387,"props":1437,"children":1439},{"class":1389,"line":1438},5,[1440,1445,1451,1456,1461,1466,1470],{"type":45,"tag":1387,"props":1441,"children":1442},{"style":1394},[1443],{"type":51,"value":1444},"#### [",{"type":45,"tag":1387,"props":1446,"children":1448},{"style":1447},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1449],{"type":51,"value":1450},"GHA-001",{"type":45,"tag":1387,"props":1452,"children":1453},{"style":1394},[1454],{"type":51,"value":1455},"]",{"type":45,"tag":1387,"props":1457,"children":1458},{"style":1394},[1459],{"type":51,"value":1460}," [",{"type":45,"tag":1387,"props":1462,"children":1463},{"style":1447},[1464],{"type":51,"value":1465},"Title",{"type":45,"tag":1387,"props":1467,"children":1468},{"style":1394},[1469],{"type":51,"value":1455},{"type":45,"tag":1387,"props":1471,"children":1472},{"style":1400},[1473],{"type":51,"value":1474}," (Severity: Critical\u002FHigh\u002FMedium)\n",{"type":45,"tag":1387,"props":1476,"children":1478},{"class":1389,"line":1477},6,[1479,1484,1490,1496,1501,1507,1512,1517],{"type":45,"tag":1387,"props":1480,"children":1481},{"style":1394},[1482],{"type":51,"value":1483},"-",{"type":45,"tag":1387,"props":1485,"children":1487},{"style":1486},"--shiki-light:#39ADB5;--shiki-light-font-weight:bold;--shiki-default:#89DDFF;--shiki-default-font-weight:bold;--shiki-dark:#89DDFF;--shiki-dark-font-weight:bold",[1488],{"type":51,"value":1489}," **",{"type":45,"tag":1387,"props":1491,"children":1493},{"style":1492},"--shiki-light:#E53935;--shiki-light-font-weight:bold;--shiki-default:#F07178;--shiki-default-font-weight:bold;--shiki-dark:#F07178;--shiki-dark-font-weight:bold",[1494],{"type":51,"value":1495},"Workflow",{"type":45,"tag":1387,"props":1497,"children":1498},{"style":1486},[1499],{"type":51,"value":1500},"**",{"type":45,"tag":1387,"props":1502,"children":1504},{"style":1503},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1505],{"type":51,"value":1506},": ",{"type":45,"tag":1387,"props":1508,"children":1509},{"style":1394},[1510],{"type":51,"value":1511},"`",{"type":45,"tag":1387,"props":1513,"children":1514},{"style":1447},[1515],{"type":51,"value":1516},".github\u002Fworkflows\u002Frelease.yml:15",{"type":45,"tag":1387,"props":1518,"children":1519},{"style":1394},[1520],{"type":51,"value":1521},"`\n",{"type":45,"tag":1387,"props":1523,"children":1525},{"class":1389,"line":1524},7,[1526,1530,1534,1539,1543,1547,1551,1555],{"type":45,"tag":1387,"props":1527,"children":1528},{"style":1394},[1529],{"type":51,"value":1483},{"type":45,"tag":1387,"props":1531,"children":1532},{"style":1486},[1533],{"type":51,"value":1489},{"type":45,"tag":1387,"props":1535,"children":1536},{"style":1492},[1537],{"type":51,"value":1538},"Trigger",{"type":45,"tag":1387,"props":1540,"children":1541},{"style":1486},[1542],{"type":51,"value":1500},{"type":45,"tag":1387,"props":1544,"children":1545},{"style":1503},[1546],{"type":51,"value":1506},{"type":45,"tag":1387,"props":1548,"children":1549},{"style":1394},[1550],{"type":51,"value":1511},{"type":45,"tag":1387,"props":1552,"children":1553},{"style":1447},[1554],{"type":51,"value":514},{"type":45,"tag":1387,"props":1556,"children":1557},{"style":1394},[1558],{"type":51,"value":1521},{"type":45,"tag":1387,"props":1560,"children":1562},{"class":1389,"line":1561},8,[1563,1567,1571,1575,1579],{"type":45,"tag":1387,"props":1564,"children":1565},{"style":1394},[1566],{"type":51,"value":1483},{"type":45,"tag":1387,"props":1568,"children":1569},{"style":1486},[1570],{"type":51,"value":1489},{"type":45,"tag":1387,"props":1572,"children":1573},{"style":1492},[1574],{"type":51,"value":289},{"type":45,"tag":1387,"props":1576,"children":1577},{"style":1486},[1578],{"type":51,"value":1500},{"type":45,"tag":1387,"props":1580,"children":1581},{"style":1503},[1582],{"type":51,"value":1583},": HIGH — confirmed through attack path tracing\n",{"type":45,"tag":1387,"props":1585,"children":1587},{"class":1389,"line":1586},9,[1588,1592,1596,1601,1605],{"type":45,"tag":1387,"props":1589,"children":1590},{"style":1394},[1591],{"type":51,"value":1483},{"type":45,"tag":1387,"props":1593,"children":1594},{"style":1486},[1595],{"type":51,"value":1489},{"type":45,"tag":1387,"props":1597,"children":1598},{"style":1492},[1599],{"type":51,"value":1600},"Exploitation Scenario",{"type":45,"tag":1387,"props":1602,"children":1603},{"style":1486},[1604],{"type":51,"value":1500},{"type":45,"tag":1387,"props":1606,"children":1607},{"style":1503},[1608],{"type":51,"value":1609},":\n",{"type":45,"tag":1387,"props":1611,"children":1613},{"class":1389,"line":1612},10,[1614,1619],{"type":45,"tag":1387,"props":1615,"children":1616},{"style":1394},[1617],{"type":51,"value":1618},"  1.",{"type":45,"tag":1387,"props":1620,"children":1621},{"style":1503},[1622],{"type":51,"value":1623}," [Step-by-step attack]\n",{"type":45,"tag":1387,"props":1625,"children":1627},{"class":1389,"line":1626},11,[1628,1632,1636,1640,1644],{"type":45,"tag":1387,"props":1629,"children":1630},{"style":1394},[1631],{"type":51,"value":1483},{"type":45,"tag":1387,"props":1633,"children":1634},{"style":1486},[1635],{"type":51,"value":1489},{"type":45,"tag":1387,"props":1637,"children":1638},{"style":1492},[1639],{"type":51,"value":448},{"type":45,"tag":1387,"props":1641,"children":1642},{"style":1486},[1643],{"type":51,"value":1500},{"type":45,"tag":1387,"props":1645,"children":1646},{"style":1503},[1647],{"type":51,"value":1648},": [What attacker gains]\n",{"type":45,"tag":1387,"props":1650,"children":1652},{"class":1389,"line":1651},12,[1653,1657,1661,1666,1670],{"type":45,"tag":1387,"props":1654,"children":1655},{"style":1394},[1656],{"type":51,"value":1483},{"type":45,"tag":1387,"props":1658,"children":1659},{"style":1486},[1660],{"type":51,"value":1489},{"type":45,"tag":1387,"props":1662,"children":1663},{"style":1492},[1664],{"type":51,"value":1665},"Fix",{"type":45,"tag":1387,"props":1667,"children":1668},{"style":1486},[1669],{"type":51,"value":1500},{"type":45,"tag":1387,"props":1671,"children":1672},{"style":1503},[1673],{"type":51,"value":1674},": [Code that fixes the issue]\n",{"type":45,"tag":1387,"props":1676,"children":1678},{"class":1389,"line":1677},13,[1679],{"type":45,"tag":1387,"props":1680,"children":1681},{"emptyLinePlaceholder":1410},[1682],{"type":51,"value":1413},{"type":45,"tag":1387,"props":1684,"children":1686},{"class":1389,"line":1685},14,[1687,1691],{"type":45,"tag":1387,"props":1688,"children":1689},{"style":1394},[1690],{"type":51,"value":1422},{"type":45,"tag":1387,"props":1692,"children":1693},{"style":1400},[1694],{"type":51,"value":1695},"Needs Verification\n",{"type":45,"tag":1387,"props":1697,"children":1699},{"class":1389,"line":1698},15,[1700],{"type":45,"tag":1387,"props":1701,"children":1702},{"style":1503},[1703],{"type":51,"value":1704},"[MEDIUM confidence items with explanation of what to verify]\n",{"type":45,"tag":1387,"props":1706,"children":1708},{"class":1389,"line":1707},16,[1709],{"type":45,"tag":1387,"props":1710,"children":1711},{"emptyLinePlaceholder":1410},[1712],{"type":51,"value":1413},{"type":45,"tag":1387,"props":1714,"children":1716},{"class":1389,"line":1715},17,[1717,1721],{"type":45,"tag":1387,"props":1718,"children":1719},{"style":1394},[1720],{"type":51,"value":1422},{"type":45,"tag":1387,"props":1722,"children":1723},{"style":1400},[1724],{"type":51,"value":1725},"Reviewed and Cleared\n",{"type":45,"tag":1387,"props":1727,"children":1729},{"class":1389,"line":1728},18,[1730],{"type":45,"tag":1387,"props":1731,"children":1732},{"style":1503},[1733],{"type":51,"value":1734},"[Workflows reviewed and confirmed safe]\n",{"type":45,"tag":54,"props":1736,"children":1737},{},[1738],{"type":51,"value":1739},"If no findings: \"No exploitable vulnerabilities identified. All workflows reviewed and cleared.\"",{"type":45,"tag":1741,"props":1742,"children":1743},"style",{},[1744],{"type":51,"value":1745},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1747,"total":1919},[1748,1773,1787,1800,1814,1831,1845,1859,1867,1878,1888,1906],{"slug":1749,"name":1749,"fn":1750,"description":1751,"org":1752,"tags":1753,"stars":1770,"repoUrl":1771,"updatedAt":1772},"xcodebuildmcp","build and test Apple apps with XcodeBuildMCP","Official skill for XcodeBuildMCP. Use when doing iOS\u002FmacOS\u002FwatchOS\u002FtvOS\u002FvisionOS work (build, test, run, debug, log, UI automation).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1754,1757,1760,1763,1764,1767],{"name":1755,"slug":1756,"type":16},"Debugging","debugging",{"name":1758,"slug":1759,"type":16},"iOS","ios",{"name":1761,"slug":1762,"type":16},"macOS","macos",{"name":9,"slug":8,"type":16},{"name":1765,"slug":1766,"type":16},"Testing","testing",{"name":1768,"slug":1769,"type":16},"Xcode","xcode",6176,"https:\u002F\u002Fgithub.com\u002Fgetsentry\u002FXcodeBuildMCP","2026-04-06T18:13:34.8719",{"slug":1774,"name":1774,"fn":1775,"description":1776,"org":1777,"tags":1778,"stars":1770,"repoUrl":1771,"updatedAt":1786},"xcodebuildmcp-cli","build and test Apple apps via CLI","Official skill for the XcodeBuildMCP CLI. Use when doing iOS\u002FmacOS\u002FwatchOS\u002FtvOS\u002FvisionOS work (build, test, run, debug, log, UI automation).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1779,1782,1783,1784,1785],{"name":1780,"slug":1781,"type":16},"CLI","cli",{"name":1758,"slug":1759,"type":16},{"name":1761,"slug":1762,"type":16},{"name":1765,"slug":1766,"type":16},{"name":1768,"slug":1769,"type":16},"2026-04-06T18:13:36.13414",{"slug":1788,"name":1788,"fn":1789,"description":1790,"org":1791,"tags":1792,"stars":26,"repoUrl":27,"updatedAt":1799},"agents-md","maintain project instruction files","Creates and maintains concise AGENTS.md and CLAUDE.md project instruction files. Use when asked to create AGENTS.md, update AGENTS.md, maintain agent docs, set up CLAUDE.md, document repository agent conventions, or keep coding-agent instructions minimal and reference-backed.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1793,1796],{"name":1794,"slug":1795,"type":16},"Documentation","documentation",{"name":1797,"slug":1798,"type":16},"Engineering","engineering","2026-05-15T06:16:29.695991",{"slug":1801,"name":1801,"fn":1802,"description":1803,"org":1804,"tags":1805,"stars":26,"repoUrl":27,"updatedAt":1813},"blog-writing-guide","write and review engineering blog posts","Write, review, and improve blog posts for the Sentry engineering blog following Sentry's specific writing standards, voice, and quality bar. Use this skill whenever someone asks to write a blog post, draft a technical article, review blog content, improve a draft, write a product announcement, create an engineering deep-dive, or produce any written content destined for the Sentry blog or developer audience. Also trigger when the user mentions \"blog post,\" \"blog draft,\" \"write-up,\" \"announcement post,\" \"engineering post,\" \"deep dive,\" \"postmortem,\" or asks for help with technical writing for Sentry. Even if the user just says \"help me write about [feature\u002Ftopic]\" — if it sounds like it could become a Sentry blog post, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1806,1809,1810],{"name":1807,"slug":1808,"type":16},"Communications","communications",{"name":9,"slug":8,"type":16},{"name":1811,"slug":1812,"type":16},"Technical Writing","technical-writing","2026-05-15T06:16:33.38217",{"slug":1815,"name":1815,"fn":1816,"description":1817,"org":1818,"tags":1819,"stars":26,"repoUrl":27,"updatedAt":1830},"brand-guidelines","write copy following Sentry brand guidelines","Write copy following Sentry brand guidelines. Use when writing UI text, error messages, empty states, onboarding flows, 404 pages, documentation, marketing copy, or any user-facing content. Covers both Plain Speech (default) and Sentry Voice tones.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1820,1823,1826,1827],{"name":1821,"slug":1822,"type":16},"Branding","branding",{"name":1824,"slug":1825,"type":16},"Content Creation","content-creation",{"name":9,"slug":8,"type":16},{"name":1828,"slug":1829,"type":16},"UX Copy","ux-copy","2026-05-15T06:16:22.395707",{"slug":1832,"name":1832,"fn":1833,"description":1834,"org":1835,"tags":1836,"stars":26,"repoUrl":27,"updatedAt":1844},"claude-settings-audit","generate Claude Code settings permissions","Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1837,1840,1843],{"name":1838,"slug":1839,"type":16},"Claude Code","claude-code",{"name":1841,"slug":1842,"type":16},"Configuration","configuration",{"name":14,"slug":15,"type":16},"2026-05-15T06:16:44.335977",{"slug":1846,"name":1846,"fn":1847,"description":1848,"org":1849,"tags":1850,"stars":26,"repoUrl":27,"updatedAt":1858},"code-review","perform code reviews for Sentry projects","Perform code reviews following Sentry engineering practices. Use when reviewing pull requests, examining code changes, or providing feedback on code quality. Covers security, performance, testing, and design review.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1851,1853,1854,1857],{"name":1852,"slug":1846,"type":16},"Code Review",{"name":1797,"slug":1798,"type":16},{"name":1855,"slug":1856,"type":16},"Performance","performance",{"name":14,"slug":15,"type":16},"2026-05-15T06:16:35.824864",{"slug":1860,"name":1860,"fn":1861,"description":1862,"org":1863,"tags":1864,"stars":26,"repoUrl":27,"updatedAt":1866},"code-simplifier","simplify and refine source code","Simplifies and refines code for clarity, consistency, and maintainability while preserving all functionality. Use when asked to \"simplify code\", \"clean up code\", \"refactor for clarity\", \"improve readability\", or review recently modified code for elegance. Focuses on project-specific best practices.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1865],{"name":24,"slug":25,"type":16},"2026-05-15T06:16:32.127981",{"slug":1868,"name":1868,"fn":1869,"description":1870,"org":1871,"tags":1872,"stars":26,"repoUrl":27,"updatedAt":1877},"commit","create commits with Sentry conventions","Use for every request to commit changes or draft a commit message. Creates Sentry-style conventional commits with issue references.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1873,1876],{"name":1874,"slug":1875,"type":16},"Git","git",{"name":9,"slug":8,"type":16},"2026-07-18T05:15:10.723937",{"slug":1879,"name":1879,"fn":1880,"description":1881,"org":1882,"tags":1883,"stars":26,"repoUrl":27,"updatedAt":1887},"create-branch","create git branches for Sentry workflows","Create a git branch following Sentry naming conventions. Use when asked to \"create a branch\", \"new branch\", \"start a branch\", \"make a branch\", \"switch to a new branch\", or when starting new work on the default branch.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1884,1885,1886],{"name":1797,"slug":1798,"type":16},{"name":1874,"slug":1875,"type":16},{"name":9,"slug":8,"type":16},"2026-05-15T06:16:39.458431",{"slug":1889,"name":1889,"fn":1890,"description":1891,"org":1892,"tags":1893,"stars":26,"repoUrl":27,"updatedAt":1905},"django-access-review","review Django access control and IDOR","Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python\u002FDjango code handling user authorization. Trigger keywords: \"IDOR\", \"access control\", \"authorization\", \"Django permissions\", \"object permissions\", \"tenant isolation\", \"broken access\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1894,1897,1898,1901,1904],{"name":1895,"slug":1896,"type":16},"Access Control","access-control",{"name":24,"slug":25,"type":16},{"name":1899,"slug":1900,"type":16},"Django","django",{"name":1902,"slug":1903,"type":16},"Python","python",{"name":14,"slug":15,"type":16},"2026-05-15T06:16:43.098698",{"slug":1907,"name":1907,"fn":1908,"description":1909,"org":1910,"tags":1911,"stars":26,"repoUrl":27,"updatedAt":1918},"django-perf-review","review and optimize Django performance","Django performance code review. Use when asked to \"review Django performance\", \"find N+1 queries\", \"optimize Django\", \"check queryset performance\", \"database performance\", \"Django ORM issues\", or audit Django code for performance problems.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1912,1913,1916,1917],{"name":1852,"slug":1846,"type":16},{"name":1914,"slug":1915,"type":16},"Database","database",{"name":1899,"slug":1900,"type":16},{"name":1855,"slug":1856,"type":16},"2026-05-15T06:16:24.832813",88,{"items":1921,"total":1962},[1922,1927,1933,1940,1946,1953,1957],{"slug":1788,"name":1788,"fn":1789,"description":1790,"org":1923,"tags":1924,"stars":26,"repoUrl":27,"updatedAt":1799},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1925,1926],{"name":1794,"slug":1795,"type":16},{"name":1797,"slug":1798,"type":16},{"slug":1801,"name":1801,"fn":1802,"description":1803,"org":1928,"tags":1929,"stars":26,"repoUrl":27,"updatedAt":1813},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1930,1931,1932],{"name":1807,"slug":1808,"type":16},{"name":9,"slug":8,"type":16},{"name":1811,"slug":1812,"type":16},{"slug":1815,"name":1815,"fn":1816,"description":1817,"org":1934,"tags":1935,"stars":26,"repoUrl":27,"updatedAt":1830},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1936,1937,1938,1939],{"name":1821,"slug":1822,"type":16},{"name":1824,"slug":1825,"type":16},{"name":9,"slug":8,"type":16},{"name":1828,"slug":1829,"type":16},{"slug":1832,"name":1832,"fn":1833,"description":1834,"org":1941,"tags":1942,"stars":26,"repoUrl":27,"updatedAt":1844},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1943,1944,1945],{"name":1838,"slug":1839,"type":16},{"name":1841,"slug":1842,"type":16},{"name":14,"slug":15,"type":16},{"slug":1846,"name":1846,"fn":1847,"description":1848,"org":1947,"tags":1948,"stars":26,"repoUrl":27,"updatedAt":1858},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1949,1950,1951,1952],{"name":1852,"slug":1846,"type":16},{"name":1797,"slug":1798,"type":16},{"name":1855,"slug":1856,"type":16},{"name":14,"slug":15,"type":16},{"slug":1860,"name":1860,"fn":1861,"description":1862,"org":1954,"tags":1955,"stars":26,"repoUrl":27,"updatedAt":1866},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1956],{"name":24,"slug":25,"type":16},{"slug":1868,"name":1868,"fn":1869,"description":1870,"org":1958,"tags":1959,"stars":26,"repoUrl":27,"updatedAt":1877},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1960,1961],{"name":1874,"slug":1875,"type":16},{"name":9,"slug":8,"type":16},28]