New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

GitHub Actions Pin Audit

by hewigovens in hewigovens/jayjay

Audit unpinned GitHub Actions references or related bot PRs.

Custom licenceAuto-check passedDevOps & Cloud

Install GitHub Actions Pin Audit

skills CLI
$ npx skills add hewigovens/jayjay --skill github-actions-pin-audit -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install hewigovens/jayjay github-actions-pin-audit --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/hewigovens/jayjay.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/github-actions-pin-audit .claude/skills/github-actions-pin-audit && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
github-actions-pin-audit
GitHub stars
172
Token cost
~558 tokens
SKILL.md length
268 words
Files
1
Skills in repo
6
Repo updated
First seen
Licence
Custom licence

At a glance

Audit unpinned GitHub Actions references or related bot PRs.

  • Works in 5 steps: Inventory references in the requested… → For each mutable third-party ref,… → When fixes are authorized, replace the… → …
  • Tasks that involve CI/CD
  • SKILL.md covers When to use, Procedure, Pitfalls and Report
  • Calls rg, git and ruby; reaches github.com

What it does

GitHub Actions Pin Audit is an agent skill from hewigovens/jayjay. Audit unpinned GitHub Actions references or related bot PRs. Verify and replace pins when fixes are requested.

Its SKILL.md is about 560 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in DevOps & Cloud, covering CI/CD. It works with GitHub Actions, Rust and macOS. The repository describes itself as: A native macOS GUI for Jujutsu (jj) — DAG graph, side-by-side diffs, interdiff, conflict resolution. Built with Rust + SwiftUI.

When your agent uses it

  • Tasks that involve CI/CD

Example prompts

  • “/github-actions-pin-audit”

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Inventory references in the requested scope. For a repository-wide audit, include all workflows; for a selected PR or finding, keep edits…
  2. For each mutable third-party ref, resolve the intended commit and check the annotated tag's peeled target
  3. When fixes are authorized, replace the ref with the full SHA and keep the version as a trailing comment (@ # v7.0.0) so the pin stays…
  4. After edits, re-run the inventory, parse the changed YAML, and run actionlint when available. Report unavailable validators. For a syntax…
  5. When superseding a bot pull request, leave it untouched and say the new change supersedes it. Pushing and opening the pull request follow…

What it can do on your machine

Read from SKILL.md and the folder at commit 5036008. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • rg
    • git
    • ruby

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

GitHub Actions Pin Audit loads about 558 tokens when it runs. Until then it costs about 34 tokens; SKILL.md has 268 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~34
When it runs · the whole SKILL.md, loaded when a task matches
~558

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 268 words (~558 tokens).

“dtolnay/rust-toolchain is pinned from upstream master history; keep with: toolchain: stable.”

— opening of SKILL.md by hewigovens, Custom licence
name
github-actions-pin-audit

Read the full SKILL.md on GitHub

Files

Just SKILL.md in .agents/skills/github-actions-pin-audit of hewigovens/jayjay.

Open the folder on GitHubat commit 5036008

Compare with similar skills

GitHub Actions Pin Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

GitHub Actions Pin Audit compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
GitHub Actions Pin Audit this skillhewigovens/jayjay172—~558Automated safety check: PassCustom licence
Reproduce macOS Python FlavorsNuitka/Nuitka15k—~1.7kAutomated safety check: PassAGPL-3.0
GitHub Actions CreatorFNOSP/FlyNarwhal4951 repos~2.4kAutomated safety check: PassAGPL-3.0
CI Pipeline Synthesizerkajisho5/ffmpeg-skill1.9k1 repos~1.1kAutomated safety check: PassMIT
GitHub Actionstddworks/ClaudeBar1.5k—~1kAutomated safety check: PassApache-2.0
Releasingmarciogranzotto/clawd-tank164—~923Automated safety check: PassMIT

Similar skills

  • Reproduce macOS Python Flavors

    Nuitka/Nuitka

    Reproduce macOS Nuitka issues across Python distributions and GitHub Actions Python packaging.

    15k GitHub stars~1.7k tokensUpdated today
    DevOps & CloudAuto-check passed

  • GitHub Actions Creator

    FNOSP/FlyNarwhal

    A skill your agent uses when the user wants to create, generate, or set up a GitHub Actions workflow.

    495 GitHub starsUsed in 1 repo~2.4k tokens
    DevOps & CloudAuto-check passed

  • CI Pipeline Synthesizer

    kajisho5/ffmpeg-skill

    Generate GitHub Actions CI/CD pipeline configurations for automated building and testing of library and package projects.

    1.9k GitHub starsUsed in 1 repo~1.1k tokens
    DevOps & CloudAuto-check passed

  • GitHub Actions

    tddworks/ClaudeBar

    Manage ClaudeBar's GitHub Actions CI/CD pipelines: build, test, and release workflows.

    1.5k GitHub stars~1k tokensUpdated today
    DevOps & CloudAuto-check passed

  • Releasing

    marciogranzotto/clawd-tank

    Cuts a new versioned release of the Clawd Tank macOS menu bar app.

    164 GitHub stars~923 tokensUpdated 4 mo ago
    DevOps & CloudAuto-check passed

  • CI Runner Audit

    apache/magpie

    Read-only audit of GitHub Actions runner compatibility for one repository, a repository set, one Apache project, or the full Apache org.

    112 GitHub stars~2.4k tokensUpdated today
    DevOps & CloudAuto-check passed

More from hewigovens/jayjay

  • CI Workflow Audit

    hewigovens/jayjay

    Audit GitHub Actions duplication, timing, filters, and gates.

    172 GitHub stars~703 tokensUpdated today
    Auto-check passed

  • Local Rebase

    hewigovens/jayjay

    Rebase a local jj feature stack onto the requested trunk when explicitly asked, without publishing.

    172 GitHub stars~786 tokensUpdated today
    Auto-check passed

  • Refresh Agent Guidance

    hewigovens/jayjay

    Refine repository agent docs and skills from supplied corrections, recurring findings, or a guidance-maintenance request.

    172 GitHub stars~1k tokensUpdated today
    Auto-check passed

  • Review Triage

    hewigovens/jayjay

    Pre-mark straightforward files and hunks of a change as reviewed through the jayjay review CLI, and flag only critical risks before a human review starts.

    172 GitHub stars~844 tokensUpdated today
    Auto-check passed

  • Gpui Parity Audit

    hewigovens/jayjay

    Check GPUI Linux parity against SwiftUI workflows, or close identified gaps when implementation is requested.

    172 GitHub stars~546 tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about GitHub Actions Pin Audit

What does GitHub Actions Pin Audit do?

Audit unpinned GitHub Actions references or related bot PRs. GitHub Actions Pin Audit is an agent skill from hewigovens/jayjay. Audit unpinned GitHub Actions references or related bot PRs.

When should I use GitHub Actions Pin Audit?

GitHub Actions Pin Audit fits situations like: tasks that involve CI/CD.

How do I install GitHub Actions Pin Audit in Claude Code?

Run `npx skills add hewigovens/jayjay --skill github-actions-pin-audit -a claude-code`. Or copy the skill folder (.agents/skills/github-actions-pin-audit in hewigovens/jayjay) into .claude/skills/github-actions-pin-audit in your project. Claude Code loads it when a task matches its description.

How do I install GitHub Actions Pin Audit in Codex?

Run `npx skills add hewigovens/jayjay --skill github-actions-pin-audit -a codex`. Or copy the skill folder (.agents/skills/github-actions-pin-audit in hewigovens/jayjay) into .agents/skills/github-actions-pin-audit in your project. Codex loads it when a task matches its description.

Can I use GitHub Actions Pin Audit in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add hewigovens/jayjay --skill github-actions-pin-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/github-actions-pin-audit, .gemini/skills/github-actions-pin-audit, .github/skills/github-actions-pin-audit and .opencode/skills/github-actions-pin-audit in your project.

What does GitHub Actions Pin Audit need to run?

Going by SKILL.md and its folder, GitHub Actions Pin Audit needs the command-line tools its instructions call (rg, git and ruby).

Does GitHub Actions Pin Audit access the network?

SKILL.md names 1 domain. In commands or code: github.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.

Is GitHub Actions Pin Audit safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does GitHub Actions Pin Audit use?

GitHub Actions Pin Audit has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.

How many tokens does GitHub Actions Pin Audit use?

About 558 tokens (SKILL.md is roughly 2.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to GitHub Actions Pin Audit?

Skills that share tags, products or a category with GitHub Actions Pin Audit: Reproduce macOS Python Flavors (Nuitka/Nuitka, 15k stars), GitHub Actions Creator (FNOSP/FlyNarwhal, 495 stars), CI Pipeline Synthesizer (kajisho5/ffmpeg-skill, 1.9k stars) and GitHub Actions (tddworks/ClaudeBar, 1.5k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains GitHub Actions Pin Audit?

hewigovens (a GitHub user) maintains it in hewigovens/jayjay, which has 172 GitHub stars. The repository holds 6 skills in this directory. The repository was last updated on October 8, 2026.

Source: hewigovens/jayjay on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.