# Trail of Bits Agentic Actions Auditor

> Draft · awaiting review.

> Claude Code plugin that statically audits GitHub Actions workflows which invoke AI coding agents for injection and permission flaws.

- Badge: `reach 2 · not run yet`
- Type: Plugin; tier: not run yet
- Tasks: Agent supply-chain scan, Code review and static analysis (SAST); mission: Agent security; works with: Claude Code, Codex
- Source: https://github.com/trailofbits/skills (plugins/agentic-actions-auditor), pinned to `5c99c03` (1.3.2), licence CC-BY-SA-4.0
- Last checked: 2026-10-19; next check: 2027-01-17; method v0.1, reach-v0.1

## At a glance

- **What it is:** A Claude Code plugin whose single skill guides the AI client's model through a static audit of GitHub Actions workflows that invoke Claude Code Action, Gemini CLI, OpenAI Codex or GitHub AI Inference, tracing where attacker-controlled input reaches the agent. A plugin bundles skills, commands, hooks or MCP servers for one AI client.
- **Made for:** Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines. +1 more
- **Runs:** Inside your AI client: its model follows the instructions and works with the client's own tools. Other modes: remote analysis mode.
- **Sends data to:** GitHub API (named repository) (if you turn it on), GitHub API (referenced repositories) (by default). Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** Runs commands, according to the capabilities read.
- **Needs:** Claude Code with the trailofbits/skills plugin marketplace added; the root README also documents Codex · The GitHub CLI (gh) for remote analysis mode and remote cross-file fetches · An authenticated gh session (gh auth login) for remote fetches · +1 more

Profile read at commit `5c99c03` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

A Claude Code plugin whose single skill guides the AI client's model through a static audit of GitHub Actions workflows that invoke Claude Code Action, Gemini CLI, OpenAI Codex or GitHub AI Inference, tracing where attacker-controlled input reaches the agent. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L3)

Made for (the author says):

- Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L3)
- Produces a structured findings report per attack vector with severity ratings and remediation guidance. (plugins/agentic-actions-auditor/README.md#L63)

Documented uses:

- Audit a repository's GitHub Actions workflows for AI agent security issues [Code review and static analysis (SAST)] (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L13)
- Check whether attacker-controlled input can reach AI agent prompts in workflows [Code review and static analysis (SAST)] (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L15)
- Evaluate agentic action configurations: sandbox settings, tool permissions and user allowlists [Agent supply-chain scan] (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L16)
- Assess trigger events such as pull_request_target and issue_comment that expose workflows to external input [Code review and static analysis (SAST)] (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L17)

Not for (the author says):

- Not for runtime prompt injection testing; the author calls it static analysis guidance, not exploitation. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L24)
- Not for non-GitHub CI/CD systems such as Jenkins, GitLab CI or CircleCI. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L25)
- Not for auto-fixing or modifying workflow files; the skill reports findings and does not modify files. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L26)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| Step 0: Determine Analysis Mode | Parses owner/repo or a GitHub URL with optional ref and fetches the workflow directory listing and file contents with gh api (remote analysis mode). (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L68-74) | reads, runs commands | no |
| Step 1: Discover Workflow Files | Globs .github/workflows/*.yml and *.yaml at the repository root and reads each workflow file. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L111) | reads | yes |
| Step 2: Identify AI Action Steps | Matches each step's uses: against five known AI action references and records file, job, step, action reference and type. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L124) | reads | yes |
| Cross-File Resolution | Resolves local composite actions and local or remote reusable workflows referenced by uses:, one level deep, reading from disk or via gh api. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/cross-file-resolution.md#L15) | reads, runs commands | yes |
| Step 3: Capture Security Context | Captures with: fields per action type, trigger events, env: blocks at three scopes and permissions: blocks for each AI action step. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L164) | reads | yes |
| Step 4: Analyze for Attack Vectors | Checks vectors A to I (injection paths, eval of AI output, dangerous sandbox configs, wildcard allowlists) using the per-vector reference files. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L232) | reads | yes |

## How it runs

Markdown instructions (SKILL.md plus reference files) that the AI client's model follows with Read, Grep, Glob and Bash; it reads local .github/workflows files or calls gh api against the GitHub Contents API for remote repositories and referenced reusable workflows. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L4)

- Starts: Inside your AI client: its model follows the instructions and works with the client's own tools. Runs as skill instructions inside Claude Code, activated when Claude detects workflow files with AI agent action references. (plugins/agentic-actions-auditor/README.md#L57)
- Can also run: Inside your AI client: its model follows the instructions and works with the client's own tools (remote analysis mode). Remote analysis mode applies when the user gives a GitHub URL or owner/repo; otherwise local analysis mode is used. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L50)
- Your AI client: **SKILL.md (agentic-actions-auditor)**: SKILL.md holds the audit methodology Step 0 to Step 5 that the model follows in order. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L46)
- Your AI client: **references/ files**: Reference files: foundations, action-profiles, cross-file-resolution and vector-a to vector-i detection heuristics. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L324)
- Your machine: **.github/workflows files**: Workflow YAML files under .github/workflows at the repository root, read in local analysis mode. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L120)
- Your machine: **gh CLI**: The GitHub CLI, called through Bash for gh api fetches and gh auth status. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L100)
- Outside your machine: **GitHub Contents API**: GitHub Contents API, the source of workflow, action.yml and reusable workflow files in remote fetches. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/cross-file-resolution.md#L44)
- Sends data to GitHub API (named repository) (your targets, if you turn it on): Fetches the workflow directory listing and base64-decoded workflow contents of the named repository via gh api. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L80)
- Sends data to GitHub API (referenced repositories) (other, by default): Fetches remote reusable workflows referenced by job-level uses: from their repositories at the given ref via gh api. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/cross-file-resolution.md#L86-88)

## What you need

- Runtime: Claude Code with the trailofbits/skills plugin marketplace added; the root README also documents Codex. (README.md#L12)
- Other tools: The GitHub CLI (gh) for remote analysis mode and remote cross-file fetches. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L68)
- Credentials: An authenticated gh session (gh auth login) for remote fetches. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L91)
- Credentials: Private repositories are reachable when the gh token in use has permissions for them. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L92)
- Installer: Adds the trailofbits/skills marketplace from GitHub with /plugin marketplace add, naming the repository without a ref or version; the plugin is then picked in /plugin menu. (README.md#L12)
- Installer: The plugin README installs via /plugin menu in a project with the Trail of Bits internal marketplace configured, selecting agentic-actions-auditor in the Security Tooling section. (plugins/agentic-actions-auditor/README.md#L35-41)
- Installer: For Codex, the root README adds the marketplace with codex plugin marketplace add trailofbits/skills and installs with codex plugin add <plugin-name>@trailofbits. (README.md#L28-30)

## Limits and risks

- The SKILL.md frontmatter lists Bash in allowed-tools next to Read, Grep and Glob, without a command pattern on Bash. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L4)
- Bash use is bounded by instruction: the skill tells the model to use Bash for gh api and gh auth status and never to pipe fetched content to a shell or interpreter. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L99-107)
- Cross-file resolution stops at one level; references found inside resolved files are logged as unresolved. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/cross-file-resolution.md#L5)
- Remote actions referenced as owner/repo@ref outside .github/workflows/ are skipped silently and their action.yml is not fetched. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/cross-file-resolution.md#L17)
- In Vector C the prompt tells the agent to fetch attacker-controlled content with gh CLI commands at runtime; the author notes the fetched content itself is invisible to static YAML analysis. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/vector-c-cli-data-fetch.md#L3)
- Vector F (subshell expansion) is confirmed for Gemini CLI; for Claude Code Action and OpenAI Codex the author says it needs runtime testing to confirm exploitability. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/vector-f-subshell-expansion.md#L14)
- AI steps are identified by prefix-matching uses: against five listed action references, ignoring the version or ref after @. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L138)
- The skill tells the model not to pre-check gh auth status but to attempt the gh api call and handle auth or 404 failures afterwards. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L89)
- Findings for dangerous sandbox configs (Vector H) or wildcard allowlists (Vector I) are rated Info or Low when no injection vector A to G occurs with them. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L276)
- Workflows that use no AI agent actions are out of scope; the author points to general Actions security tools for them. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L22)
- Workflow discovery covers .github/workflows/ at the repository root; subdirectories, vendored code and test fixtures are not scanned. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L120)
- Standalone composite actions or reusable workflows are reviewed only through a caller workflow that references them via uses:. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md#L23)
- Local actions whose runs.using is not composite (JavaScript or Docker actions) are skipped and not logged as unresolved, so the report's Unresolved References section does not list them. (plugins/agentic-actions-auditor/skills/agentic-actions-auditor/references/cross-file-resolution.md#L56)

## Rights in plain language

- Declared: files 0 (reads only files you give it), network 1 (talks only to declared hosts), execution 1 (runs only declared programs), secrets 1 (uses one scoped token), approval 2 (has broad pre-approvals).
- Code: reach 2 (open): execution 2 (runs shell commands or eval), approval 2 (has broad pre-approvals).
- Lab: not run yet.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 2 (open).

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | 0 reads only files you give it | 0 reads only files you give it | not run yet |
| Network: whom does it talk to? | 1 talks only to declared hosts | 1 talks only to declared hosts | not run yet |
| Execution: what does it run? | 1 runs only declared programs | 2 runs shell commands or eval | not run yet |
| Secrets: which credentials does it touch? | 1 uses one scoped token | 1 uses one scoped token | not run yet |
| Persistence: what survives the run? | not declared | 0 leaves results only | not run yet |
| Approval: does it ask before acting? | 2 has broad pre-approvals | 2 has broad pre-approvals | not run yet |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Upstream

Quoted from `README.md#L12-18` at the pinned commit (not a command to copy): `/plugin marketplace add trailofbits/skills
/plugin menu`


### Run it with least privilege

- claude code: `scope Bash to gh api and gh auth status only; the skill itself never needs write access`
- note: `derived from the code, not tested in the lab`

- derived, not tested: proposed from the code analysis

## Lab runs

Not run yet.

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does Trail of Bits Agentic Actions Auditor declare?**

files 0 (reads only files you give it), network 1 (talks only to declared hosts), execution 1 (runs only declared programs), secrets 1 (uses one scoped token), approval 2 (has broad pre-approvals).

**What does its code suggest?**

reach 2 (open): execution 2 (runs shell commands or eval), approval 2 (has broad pre-approvals).

**What did it use when it ran in the lab?**

not run yet.

**Was it tried, and when?**

Not yet (tier listed).

**What changed since the last check?**

Upstream last pushed 2026-10-15; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Derived, not tested: claude_code: scope Bash to gh api and gh auth status only; the skill itself never needs write access; note: derived from the code, not tested in the lab

Method: https://readbeforerun.ai/method/