Audit GitHub Actions cloud auth workflows for OIDC hardening gaps like missing id-token write permissions, static cloud secrets, and floating auth action refs.
请根据来源仓库和你的 AI 工具说明安装此技能。先阅读技能文件和依赖要求，再添加到工作流。
SkillHub CLI
skillhub install daniellummis/github-actions-oidc-hardening-audit打开来源仓库，查看说明和兼容环境后，按来源提供的命令或步骤安装。
将来源链接提供给你的 Agent，让它先读取说明、核对依赖，并向你说明将执行的安装步骤。
Use this skill to catch risky cloud-auth patterns in workflow YAML before they become identity or secret exposure incidents.
.github/workflows/*.yml by default)aws-actions/configure-aws-credentials
google-github-actions/auth
azure/login
permissions.id-token: write
role-to-assume
aws-access-key-id, aws-secret-access-key, cloud credential secrets)@main, @master, @v1) unless allow-listedOptional:
WORKFLOW_GLOB (default: .github/workflows/*.y*ml)TOP_N (default: 20)OUTPUT_FORMAT (text or json, default: text)WARN_SCORE (default: 3)CRITICAL_SCORE (default: 7)WORKFLOW_FILE_MATCH / WORKFLOW_FILE_EXCLUDE (regex, optional)ALLOW_REF_REGEX (regex, optional) — allow-listed action refsFAIL_ON_CRITICAL (0 or 1, default: 0)Text report:
WORKFLOW_GLOB='.github/workflows/*.yml' \
WARN_SCORE=3 \
CRITICAL_SCORE=7 \
bash skills/github-actions-oidc-hardening-audit/scripts/oidc-hardening-audit.sh
JSON output + fail gate:
WORKFLOW_GLOB='.github/workflows/*.y*ml' \
OUTPUT_FORMAT=json \
FAIL_ON_CRITICAL=1 \
bash skills/github-actions-oidc-hardening-audit/scripts/oidc-hardening-audit.sh
Run against bundled fixtures:
WORKFLOW_GLOB='skills/github-actions-oidc-hardening-audit/fixtures/*.y*ml' \
bash skills/github-actions-oidc-hardening-audit/scripts/oidc-hardening-audit.sh
0 in reporting mode (default)1 when FAIL_ON_CRITICAL=1 and one or more workflows are critical这些信息来自收录时的来源分析，可能滞后；使用前请核对最新来源文件。
# GitHub Actions OIDC Hardening Audit Use this skill to catch risky cloud-auth patterns in workflow YAML before they become identity or secret exposure incidents. ## What this skill does - Scans workflow YAML files (`.github/workflows/*.yml` by default) - Detects AWS/GCP/Azure auth action usage: - `aws-actions/configure-aws-credentials` - `google-github-actions/auth` - `azure/login` - Flags workflows that use cloud auth actions but miss `permissions.id-token: write` - Flags AWS auth usage without `role-to-assume` - Flags likely static cloud credential usage (`aws-access-key-id`, `aws-secret-access-key`, cloud credential secrets) - Flags floating auth action refs (`@main`, `@master`, `@v1`) unless allow-listed - Supports text/json output and CI fail gate ## Inputs Optional: - `WORKFLOW_GLOB` (default: `.github/workflows/*.y*ml`) - `TOP_N` (default: `20`) - `OUTPUT_FORMAT` (`text` or `json`, default: `text`) - `WARN_SCORE` (default: `3`) - `CRITICAL_SCORE` (default: `7`) - `WORKFLOW_FILE_MATCH` / `WORKFLOW_FILE_EXCLUDE` (regex, optional) - `ALLOW_REF_REGEX` (regex, optional) — allow-listed action refs - `FAIL_ON_CRITICAL` (`0` or `1`, default: `0`) ## Run Text report: ```bash WORKFLOW_GLOB='.github/workflows/*.yml' \ WARN_SCORE=3 \ CRITICAL_SCORE=7 \ bash skills/github-actions-oidc-hardening-audit/scripts/oidc-hardening-audit.sh ``` JSON output + fail gate: ```bash WORKFLOW_GLOB='.github/workflows/*.y*ml' \ OUTPUT_FORMAT=json \ FAIL_ON_CRITICAL=1 \ bash skills/github-actions-oidc-hardening-audit/scripts/oidc-hardening-audit.sh ``` Run against bundled fixtures: ```bash WORKFLOW_GLOB='skills/github-actions-oidc-hardening-audit/fixtures/*.y*ml' \ bash skills/github-actions-oidc-hardening-audit/scripts/oidc-hardening-audit.sh ``` ## Output contract - Exit `0` in reporting mode (default) - Exit `1` when `FAIL_ON_CRITICAL=1` and one or more workflows are critical - Text mode prints summary + top risky workflows - JSON mode prints summary + flagged workflows...
Bambu Lab 3D printer control and automation. Activate when user mentions: printer status, 3D printing, slice, analyze model, generate 3D, AMS filament, print monitor, Bambu Lab, or any 3D printing task. Full pi...
Generative Engine Optimization (GEO) for AI search visibility. Optimize content to appear in ChatGPT, Perplexity, Claude, and Google AI Overviews. Use when optimizing websites, pages, or content for LLM discove...
Agents can sign plugins, rotate credentials without losing identity, and publicly attest to behavior.
Send and receive P2P messages using disposable numbers and PINs. No servers, no accounts. Use for human notifications, approval flows, and agent-to-agent communication.