New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Official agent skill

Action Audit

by bitwarden in bitwarden/ai-plugins

Audit GitHub Actions action usage across an org. An agent skill from bitwarden/ai-plugins.

OfficialCustom licenceAuto-check passedDevOps & Cloud

Install Action Audit

skills CLI
$ npx skills add bitwarden/ai-plugins --skill action-audit -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install bitwarden/ai-plugins action-audit --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/bitwarden/ai-plugins.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/bitwarden-devops-engineer/skills/action-audit .claude/skills/action-audit && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
action-audit
GitHub stars
154
Token cost
~1.5k tokens
SKILL.md length
634 words
Files
1
Skills in repo
33
Repo updated
First seen
Licence
Custom licence

At a glance

Audit GitHub Actions action usage across an org. An agent skill from bitwarden/ai-plugins.

  • Works in 5 steps: Parse Context → Search Org-Wide → Parse and Display Results → …
  • Action-audit in incident mode for that action </example <example User: Can you find all unpinned actions across the org?
  • SKILL.md covers Rules, Pin Compliance Rules, Modes and Step 1: Parse Context, plus 4 more sections
  • Calls gh; reaches github.com

What it does

Action Audit is an agent skill from bitwarden/ai-plugins, published by the product's own GitHub organization. Audit GitHub Actions action usage across an org. Searches for a specific action (incident mode) or sweeps all workflow files for non-compliant action references (audit mode). Produces a read-only report of findings with compliance status and resolved SHAs. Does not modify any files. <example User: We need to check if any repos are using tj-actions/changed-files Action: Trigger action-audit in incident mode for that action </example <example User: Can you find all unpinned actions across the org? Action: Trigger…

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in DevOps & Cloud, covering CI/CD. It works with GitHub Actions. The repository describes itself as: AI plugin marketplace.

When your agent uses it

  • Action-audit in incident mode for that action </example <example User: Can you find all unpinned actions across the org?
  • Action-audit in audit mode </example

Example prompts

  • “/action-audit”

Requirements

  • Pre-approved tools (allowed-tools): Read, Glob, Grep, Bash(gh search code:*), Bash(gh api:*)

Workflow steps

5 steps, taken from the step headings in SKILL.md.

  1. Parse Context
  2. Search Org-Wide
  3. Parse and Display Results
  4. Resolve Remediation Targets
  5. Summary Report

What it can do on your machine

Read from SKILL.md and the folder at commit 53e22a3. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Glob
    • Grep
    • Bash(gh search code:*)
    • Bash(gh api:*)

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • gh

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Action Audit loads about 1.5k tokens when it runs. Until then it costs about 143 tokens; SKILL.md has 634 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~143
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 634 words (~1,499 tokens).

“Before classifying any action reference, read ${CLAUDE_PLUGIN_ROOT}/skills/bitwarden-workflow-linter-rules/SKILL.md and apply the step_pinned rule as the compliance definition for all steps below. That skill is the single source of truth for what is and is not compliant.”

— opening of SKILL.md by bitwarden, Custom licence
name
action-audit
allowed-tools
Read, Glob, Grep, Bash(gh search code:*), Bash(gh api:*)

Read the full SKILL.md on GitHub

Files

Just SKILL.md in plugins/bitwarden-devops-engineer/skills/action-audit of bitwarden/ai-plugins.

Open the folder on GitHubat commit 53e22a3

Compare with similar skills

Action Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Action Audit compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Action Audit this skillbitwarden/ai-plugins154—~1.5kAutomated safety check: PassCustom licence
Analyze GitHub Action Logswithastro/astro63k1 repos~1.3kAutomated safety check: PassCustom licence
GitHub Actions Templatesbartstc/vite-ts-react-template12214 repos~1.9kAutomated safety check: PassMIT
Nushellccusage/ccusage19k—~938Automated safety check: PassCustom licence
Repo Hygiene Scan and FixQwenLM/qwen-code28k—~1.7kAutomated safety check: PassApache-2.0
Senior DevOps Toolkitmaslennikov-ig/claude-code-orchestrator-kit2606 repos~1.1kAutomated safety check: NotesCustom licence

Similar skills

  • Analyze GitHub Action Logs

    withastro/astro

    Official

    Analyze recent GitHub Actions workflow runs to identify patterns, mistakes, and improvements.

    63k GitHub starsUsed in 1 repo~1.3k tokens
    DevOps & CloudAuto-check passed

  • GitHub Actions Templates

    bartstc/vite-ts-react-template

    Create production-ready GitHub Actions workflows for automated testing, building, and deploying applications.

    122 GitHub starsUsed in 14 repos~1.9k tokens
    DevOps & CloudAuto-check passed

  • Nushell

    ccusage/ccusage

    Guides ccusage Nushell scripts. An agent skill from ccusage/ccusage.

    19k GitHub stars~938 tokensUpdated today
    DevOps & CloudAuto-check passed

  • Repo Hygiene Scan and Fix

    QwenLM/qwen-code

    Scheduled CI skill that scans a repository for small, certain docs, test and code hygiene issues and fixes them on one branch with a commit per finding.

    28k GitHub stars~1.7k tokensUpdated today
    DevOps & CloudAuto-check passed

  • Senior DevOps Toolkit

    maslennikov-ig/claude-code-orchestrator-kit

    Comprehensive DevOps skill for CI/CD, infrastructure automation, containerization, and cloud platforms (AWS, GCP, Azure). Includes pipeline setup…

    260 GitHub starsUsed in 6 repos~1.1k tokens
    DevOps & CloudAuto-check: notes

  • CI Failure Triage and Repair

    Chachamaru127/claude-code-harness

    Diagnoses failing CI pipelines and tests, deciding first whether the test or the implementation is at fault, and hands hard cases to a dedicated fixer subagent.

    3.2k GitHub starsUsed in 1 repo~1.1k tokens
    DevOps & CloudAuto-check: notes

More from bitwarden/ai-plugins

All 33 skills in this repo

  • Reviewing Claude Config

    bitwarden/ai-plugins

    Official

    Reviews Claude configuration files for security, structure, and prompt engineering quality.

    154 GitHub stars~4.2k tokensUpdated today
    Auto-check passed

  • Managing Workflow Secrets

    bitwarden/ai-plugins

    Official

    Bitwarden's canonical pattern for using a secret inside a GitHub Actions job: authenticate to Azure with the OIDC triad, pull the secret from an Azure Key Vault via the bitwarden/gh-actions…

    154 GitHub stars~4k tokensUpdated today
    Auto-check passed

  • Reviewing Security Architecture

    bitwarden/ai-plugins

    Official

    This skill should be used when the user asks to "review the security architecture", "check authentication patterns", "evaluate trust boundaries", "review encryption implementation", "assess…

    154 GitHub stars~2.2k tokensUpdated today
    Auto-check passed

  • Auditing External Claude Plugins

    bitwarden/ai-plugins

    Official

    Audits an external (third-party) Claude Code plugin pinned in this marketplace for security risk before it is vendored, and writes the report to a file for downstream posting.

    154 GitHub stars~1.8k tokensUpdated today
    Auto-check passed

  • Action Remediate

    bitwarden/ai-plugins

    Official

    Remediate GitHub Actions action findings identified by the action-audit skill.

    154 GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Addressing Code Review Comments

    bitwarden/ai-plugins

    Official

    A skill your agent uses when the user is addressing pull request review comments locally and asks for help evaluating, implementing, or drafting responses to reviewer feedback - requires technical…

    154 GitHub stars~1.9k tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about Action Audit

What does Action Audit do?

Audit GitHub Actions action usage across an org. An agent skill from bitwarden/ai-plugins. Action Audit is an agent skill from bitwarden/ai-plugins, published by the product's own GitHub organization. Audit GitHub Actions action usage across an org.

When should I use Action Audit?

Action Audit fits situations like: action-audit in incident mode for that action </example <example User: Can you find all unpinned actions across the org?; action-audit in audit mode </example.

How do I install Action Audit in Claude Code?

Run `npx skills add bitwarden/ai-plugins --skill action-audit -a claude-code`. Or copy the skill folder (plugins/bitwarden-devops-engineer/skills/action-audit in bitwarden/ai-plugins) into .claude/skills/action-audit in your project. Claude Code loads it when a task matches its description.

How do I install Action Audit in Codex?

Run `npx skills add bitwarden/ai-plugins --skill action-audit -a codex`. Or copy the skill folder (plugins/bitwarden-devops-engineer/skills/action-audit in bitwarden/ai-plugins) into .agents/skills/action-audit in your project. Codex loads it when a task matches its description.

Can I use Action Audit in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add bitwarden/ai-plugins --skill action-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/action-audit, .gemini/skills/action-audit, .github/skills/action-audit and .opencode/skills/action-audit in your project.

What does Action Audit need to run?

Going by SKILL.md and its folder, Action Audit needs the command-line tools its instructions call (gh). Its frontmatter pre-approves these tools: Read, Glob, Grep, Bash(gh search code:*), Bash(gh api:*).

Does Action Audit access the network?

SKILL.md names 1 domain. In commands or code: github.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.

Is Action Audit safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Action Audit use?

Action Audit has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.

How many tokens does Action Audit use?

About 1.5k tokens (SKILL.md is roughly 6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Action Audit?

Skills that share tags, products or a category with Action Audit: Analyze GitHub Action Logs (withastro/astro, 63k stars), GitHub Actions Templates (bartstc/vite-ts-react-template, 122 stars), Nushell (ccusage/ccusage, 19k stars) and Repo Hygiene Scan and Fix (QwenLM/qwen-code, 28k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Action Audit?

bitwarden (a GitHub organization, an official publisher) maintains it in bitwarden/ai-plugins, which has 154 GitHub stars. The repository holds 33 skills in this directory. The repository was last updated on October 8, 2026.

Source: bitwarden/ai-plugins on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.