New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Secure GitHub Actions

by vechain in vechain/x-app-template

Secure GitHub Actions workflows against supply-chain, privilege, and shell-injection risks.

MITAuto-check passedDevOps & Cloud

Install Secure GitHub Actions

skills CLI
$ npx skills add vechain/x-app-template --skill secure-github-actions -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install vechain/x-app-template secure-github-actions --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/vechain/x-app-template.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/secure-github-actions .claude/skills/secure-github-actions && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
secure-github-actions
GitHub stars
450
Token cost
~1.2k tokens
SKILL.md length
493 words
Files
5 (incl. references)
Skills in repo
11
Repo updated
First seen
Licence
MIT

At a glance

Secure GitHub Actions workflows against supply-chain, privilege, and shell-injection risks.

  • Works in 9 steps: Read the relevant reference files first.… → Pin every non-local uses: reference to a… → Never invent SHAs. Resolve them from… → …
  • Reviewing .github/workflows/.yml
  • SKILL.md covers CRITICAL RULES, Operating procedure, Reference files and Tools
  • Calls brew

What it does

Secure GitHub Actions is an agent skill from vechain/x-app-template. Secure GitHub Actions workflows against supply-chain, privilege, and shell-injection risks. Use when creating, scaffolding, editing, or reviewing .github/workflows/.yml, reusable workflows, action.yml, or Dependabot config for GitHub Actions. Also use for full repository security audits ("audit my workflows", "harden this repo", "security scan", "pin actions to SHA"), secrets scanning with gitleaks and trufflehog, and pre-public-release security reviews. Enforce full 40-character commit SHA pinning, avoid…

Its SKILL.md is about 1.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including reference files (for example `references/audit-checklist.md`, `references/secure-patterns.md` and `references/sha-pinning.md`).

It sits in DevOps & Cloud, covering CI/CD, Security review and Secrets management. It works with GitHub Actions and GitHub. The repository describes itself as: Vechain VeBetterDAO X-App template. The licence is MIT.

When your agent uses it

  • Reviewing .github/workflows/.yml
  • Reusable workflows
  • Dependabot config for GitHub Actions
  • Full repository security audits (audit my workflows

Example prompts

  • “audit my workflows”
  • “harden this repo”
  • “security scan”
  • “/secure-github-actions”

Workflow steps

9 steps, taken from the first numbered list in SKILL.md.

  1. Read the relevant reference files first. When the user's request involves any topic in the reference table below, read those files before…
  2. Pin every non-local uses: reference to a full 40-character commit SHA. Treat @v*, @main, @master, branch names, and short SHAs as security…
  3. Never invent SHAs. Resolve them from GitHub or ask the user; if you cannot verify the right SHA, say so explicitly instead of fabricating…
  4. Do not introduce pull_request_target unless the user explicitly requires it and the workflow never executes untrusted code with secrets or…
  5. Never splice untrusted context directly into shell. Move ${{ github.* }}, ${{ inputs.* }}, and similar values into env: and quote the…
  6. Set explicit least-privilege permissions:. Default to read-only and grant write scopes only to the specific job that needs them.
  7. Always run the full audit checklist when asked to "audit", "harden", or "security scan" a repository.
  8. Never silently skip a check. If a tool is missing (gitleaks, trufflehog, zizmor), report it and suggest installation.
  9. After compaction or context loss, re-read this SKILL and the reference files before continuing.

What it can do on your machine

Read from SKILL.md and the folder at commit 8692b6a. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • brew

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Secure GitHub Actions loads about 1.2k tokens when it runs, and up to ~4k if it reads all its reference files. Until then it costs about 166 tokens; SKILL.md has 493 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~166
When it runs · the whole SKILL.md, loaded when a task matches
~1.2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from vechain/x-app-template at commit 8692b6a, republished under its MIT licence (© vechain). 493 words, ~1,189 tokens.

Download SKILL.mdSave it as .claude/skills/secure-github-actions/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.
name
secure-github-actions
description
Secure GitHub Actions workflows against supply-chain, privilege, and shell-injection risks. Use when creating, scaffolding, editing, or reviewing `.github/workflows/*.yml`, reusable workflows, `action.yml`, or Dependabot config for GitHub Actions. Also use for full repository security audits ("audit my workflows", "harden this repo", "security scan", "pin actions to SHA"), secrets scanning with gitleaks and trufflehog, and pre-public-release security reviews. Enforce full 40-character commit SHA pinning, avoid `pull_request_target` on untrusted code, pass GitHub context into `run:` steps via `env:`, and set least-privilege permissions.
license
MIT
metadata.author
VeChain
metadata.version
0.2.0

Secure GitHub Actions

Create, review, and audit GitHub Actions workflows with supply-chain-safe defaults.

CRITICAL RULES

  1. Read the relevant reference files first. When the user's request involves any topic in the reference table below, read those files before doing anything else. Briefly mention which files you are reading so the user can confirm the skill is active.
  2. Pin every non-local uses: reference to a full 40-character commit SHA. Treat @v*, @main, @master, branch names, and short SHAs as security debt.
  3. Never invent SHAs. Resolve them from GitHub or ask the user; if you cannot verify the right SHA, say so explicitly instead of fabricating one.
  4. Do not introduce pull_request_target unless the user explicitly requires it and the workflow never executes untrusted code with secrets or write permissions.
  5. Never splice untrusted context directly into shell. Move ${{ github.* }}, ${{ inputs.* }}, and similar values into env: and quote the shell variable.
  6. Set explicit least-privilege permissions:. Default to read-only and grant write scopes only to the specific job that needs them.
  7. Always run the full audit checklist when asked to "audit", "harden", or "security scan" a repository.
  8. Never silently skip a check. If a tool is missing (gitleaks, trufflehog, zizmor), report it and suggest installation.
  9. After compaction or context loss, re-read this SKILL and the reference files before continuing.

Operating procedure

For writing or editing workflows
  1. Classify the task: new workflow, workflow edit, reusable workflow, or security review.
  2. Read references/workflows.md and references/secure-patterns.md.
  3. Audit every uses: reference:
    • Local actions like ./.github/actions/foo are fine.
    • Step-level actions and job-level reusable workflows must use full SHAs.
    • Preserve the human release label in a comment (e.g., # v4.3.1).
  4. Audit the trust boundary:
    • Prefer pull_request over pull_request_target.
    • Assume forked PR data is untrusted.
    • Avoid exposing secrets or write tokens to untrusted code paths.
  5. Audit every run: step:
    • Pass dynamic values through env:.
    • Quote shell variables.
    • Prefer simple shell over adding a new third-party action when either works.
  6. Add or update maintenance guardrails:
    • Ensure Dependabot updates the github-actions ecosystem.
    • Call out transitive risk: pinned actions can still reference mutable actions internally.
Show full SKILL.md (141 more words)Show less
For full security audits

When asked to "audit", "harden", or "security scan" a repository:

  1. Read references/audit-checklist.md.
  2. Execute all checks, using subagents to parallelize where possible.
  3. Present findings grouped by severity: CRITICAL, HIGH, MEDIUM, LOW.
  4. End with a summary table and prioritized action list.

Reference files

TopicFileRead when...
Workflow hardening patternsreferences/workflows.mdCreating, editing, or reviewing workflows
Secure workflow templatesreferences/secure-patterns.mdWriting new workflows from scratch
Full audit procedurereferences/audit-checklist.mdRunning a security audit on a repository
SHA pinning automationreferences/sha-pinning.mdPinning actions to commit SHAs

Tools

The audit checks for these tools and reports missing ones:

ToolPurposeInstall
gitleaksScan git history for secretsbrew install gitleaks
trufflehogDeep secrets scanning with verificationbrew install trufflehog
zizmorStatic analysis for GH Actionsbrew install woodruffw/tap/zizmor
ghGitHub CLI for API callsbrew install gh

© vechain, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 4 other files (references) in .agents/skills/secure-github-actions of vechain/x-app-template.

  • SKILL.md
  • references/audit-checklist.md
  • references/secure-patterns.md
  • references/sha-pinning.md
  • references/workflows.md

Open the folder on GitHubat commit 8692b6a

Compare with similar skills

Secure GitHub Actions next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Secure GitHub Actions compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Secure GitHub Actions this skillvechain/x-app-template450—~1.2kAutomated safety check: PassMIT
Sicurezza GitHubccplugins/awesome-claude-code-plugins967—~486Automated safety check: NotesApache-2.0
Agentic GitHub Actions Auditortrailofbits/skills7.4k6 repos~5.4kAutomated safety check: NotesCC-BY-SA-4.0
GitHub Actions Hardeninggithub/awesome-copilot40k1 repos~2.4kAutomated safety check: PassMIT
Qv Devops PR Reviewtetherto/qvac674—~2.5kAutomated safety check: PassApache-2.0
GitHub Actions Supply Chain Pinningasyncapi/generator1.1k—~1.9kAutomated safety check: PassApache-2.0

Similar skills

  • Sicurezza GitHub

    ccplugins/awesome-claude-code-plugins

    Aggiunge alle repository GitHub dei siti workflow di sicurezza automatici - scansione dipendenze vulnerabili, ricerca di segreti/chiavi nel codice, analisi statica CodeQL e Dependabot.

    967 GitHub stars~486 tokensUpdated 1 mo ago
    DevOps & CloudAuto-check: notes

  • Agentic GitHub Actions Auditor

    trailofbits/skills

    Official

    Statically audits GitHub Actions workflows that run AI coding agents, tracing attacker-controlled input to agent prompts and flagging unsafe sandbox, trigger and allowlist settings.

    7.4k GitHub starsUsed in 6 repos~5.4k tokens
    SecurityAuto-check: notes

  • GitHub Actions Hardening

    github/awesome-copilot

    Official

    Security hardening reviewer for GitHub Actions workflow files (.github/workflows/.yml).

    40k GitHub starsUsed in 1 repo~2.4k tokens
    DevOps & CloudAuto-check passed

  • Qv Devops PR Review

    tetherto/qvac

    PR review for DevOps changes — runs the generic /qv-pr-review flow then layers a structured GitHub Actions security audit (action pinning, permissions, OIDC, secrets handling).

    674 GitHub stars~2.5k tokensUpdated today
    DevelopmentAuto-check passed

  • GitHub Actions Supply Chain Pinning

    asyncapi/generator

    A skill your agent uses when editing, adding, or reviewing any file under .github/workflows/, or when a CI step installs a CLI tool (npm i -g, npx, pipx, uses: /setup-).

    1.1k GitHub stars~1.9k tokensUpdated 2 days ago
    DevOps & CloudAuto-check passed

  • Workflow Security Audit

    apache/magpie

    Read-only GitHub Actions workflow security audit for one repository, a repository set, or a whole GitHub org.

    110 GitHub stars~3.8k tokensUpdated today
    SecurityAuto-check passed

More from vechain/x-app-template

All 11 skills in this repo

  • Create Vechain Dapp

    vechain/x-app-template

    Scaffold a VeChain dApp with Next.js, VeChain Kit, Chakra UI v3, and GitHub Pages deployment.

    450 GitHub stars~1.8k tokensUpdated 2 mo ago
    Auto-check passed

  • Translate

    vechain/x-app-template

    Manages translation files for react-i18next. An agent skill from vechain/x-app-template.

    450 GitHub stars~1.2k tokensUpdated 2 mo ago
    Auto-check passed

  • Frontend

    vechain/x-app-template

    Generic frontend development patterns for VeChain dApps — React Query, Turborepo architecture, state management, Chakra UI, i18n, loading states, and transaction UX.

    450 GitHub stars~1.1k tokensUpdated 2 mo ago
    Auto-check passed

  • Smart Contract Development

    vechain/x-app-template

    Solidity smart contract development on VeChainThor — Hardhat setup, ERC-20/721 patterns, upgradeable contracts, gas optimization, testing with Thor Solo, security auditing, and ABI codegen.

    450 GitHub stars~1.1k tokensUpdated 2 mo ago
    Auto-check passed

  • Vebetterdao

    vechain/x-app-template

    VeBetterDAO and X2Earn app development — B3TR/VOT3 tokens, reward distribution, sustainability proofs, app submission, governance, VeVote, quadratic funding, B3MO Quests, and navigators.

    450 GitHub stars~1.1k tokensUpdated 2 mo ago
    Auto-check passed

  • Vechain Core

    vechain/x-app-template

    Core VeChain development — SDK usage, fee delegation (VIP-191), multi-clause transactions, dual-token model, legacy migration, and general VeChainThor development patterns.

    450 GitHub stars~1.2k tokensUpdated 2 mo ago
    Auto-check passed

Works with

Categories

Questions about Secure GitHub Actions

What does Secure GitHub Actions do?

Secure GitHub Actions workflows against supply-chain, privilege, and shell-injection risks. Secure GitHub Actions is an agent skill from vechain/x-app-template. Secure GitHub Actions workflows against supply-chain, privilege, and shell-injection risks.

When should I use Secure GitHub Actions?

Secure GitHub Actions fits situations like: reviewing .github/workflows/.yml; reusable workflows; dependabot config for GitHub Actions; full repository security audits (audit my workflows.

How do I install Secure GitHub Actions in Claude Code?

Run `npx skills add vechain/x-app-template --skill secure-github-actions -a claude-code`. Or copy the skill folder (.agents/skills/secure-github-actions in vechain/x-app-template) into .claude/skills/secure-github-actions in your project. Claude Code loads it when a task matches its description.

How do I install Secure GitHub Actions in Codex?

Run `npx skills add vechain/x-app-template --skill secure-github-actions -a codex`. Or copy the skill folder (.agents/skills/secure-github-actions in vechain/x-app-template) into .agents/skills/secure-github-actions in your project. Codex loads it when a task matches its description.

Can I use Secure GitHub Actions in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add vechain/x-app-template --skill secure-github-actions -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/secure-github-actions, .gemini/skills/secure-github-actions, .github/skills/secure-github-actions and .opencode/skills/secure-github-actions in your project.

What does Secure GitHub Actions need to run?

Going by SKILL.md and its folder, Secure GitHub Actions needs the command-line tools its instructions call (brew).

Does Secure GitHub Actions access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Secure GitHub Actions safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Secure GitHub Actions use?

Secure GitHub Actions is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Secure GitHub Actions use?

About 1.2k tokens (SKILL.md is roughly 4.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.9k tokens, read only when the agent opens those files.

What are the alternatives to Secure GitHub Actions?

Skills that share tags, products or a category with Secure GitHub Actions: Sicurezza GitHub (ccplugins/awesome-claude-code-plugins, 967 stars), Agentic GitHub Actions Auditor (trailofbits/skills, 7.4k stars), GitHub Actions Hardening (github/awesome-copilot, 40k stars) and Qv Devops PR Review (tetherto/qvac, 674 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Secure GitHub Actions?

vechain (a GitHub organization) maintains it in vechain/x-app-template, which has 450 GitHub stars. The repository holds 11 skills in this directory. The repository was last updated on July 20, 2026.

Source: vechain/x-app-template on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.