Evidence record · captured 2026-10-11

GitHub Actions Exploitability Review

An exploitation-focused GitHub Actions review: every finding must come with a concrete attack scenario or it is not reported. References encode real attack patterns (pwn requests, expression injection, comment-triggered commands, credential escalation, AI prompt injection via CI, runner infrastructure, supply chain) drawn from the 2025 'HackerBot Claw' campaign analysis.

Community publisherUnverifiedSource reviewedBehavior not tested

Source review

Editorial assessment

This is a source-only assessment. It does not claim runtime or security testing.

What it does

An exploit-gated GitHub Actions review: the agent reports only what an outsider without write access could abuse, with a traced attack path. It also covers AI agents in CI reading attacker-modified instruction files.

Best for

Triage of an open-source repository's workflows where only externally exploitable issues should be raised
Reviewing workflows that run AI coding agents on pull request content
Checking issue_comment command handlers for missing author authorization

Strengths in the source

A HIGH finding needs five elements (entry point, payload, execution mechanism, impact, PoC sketch); anything less becomes MEDIUM 'needs verification', and LOW is not reported.
A 'safe patterns' table tells the agent what not to flag, such as numeric PR fields, expressions in if: or with:, and expressions in workflow_dispatch or schedule workflows.
Loads one of nine reference files per trigger found, including AI prompt injection via CLAUDE.md or AGENTS.md, runner infrastructure, and a catalog of real-world attacks.
Instructs the agent to read the full workflow and confirm gating if: conditions before reporting, and to report zero findings rather than invent issues.

Limitations

Deliberately excludes issues that need write access, so insider risk and general hardening gaps (for example tag-pinned first-party actions) are out of scope.
Static review of the repository's own files; workflows in other repositories are only noted, and GitHub App permissions are out of scope.
Attack patterns are drawn largely from one 2025 campaign analysis cited in the source, so coverage reflects techniques observed at that time.

When not to use it

Private repositories where every contributor has write access, so the external-attacker threat model barely applies
When the goal is a full least-privilege hardening pass rather than exploitable findings

Reviewed by Retenta editorial on 2026-10-11; scope: source only.

Files included in this review

skills/gha-security-review/SKILL.md

Evidence and boundaries

Execution · not tested

Retenta has not executed this skill.

Security · not tested

The skill folder bundles no executable scripts. Retenta has not run a security scan.

Pinned publisher source: skills/gha-security-review/SKILL.md
Revision: d18b7aa8ba878354e5c348310230e652f7690f9c
License evidence: Apache-2.0Retenta preserves the license text captured with this immutable upstream snapshot; no independent legal or security review is claimed.
Last source change: 2026-09-26
Independent verification: Published by Sentry, which does not own the product this skill covers. Not independently verified.
Upstream repository: Open publisher repository