[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73FP7A4RC1Z8ZX243CM5B9R":3,"skill-same:01M73FP7A4RC1Z8ZX243CM5B9R":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":54,"ownerHtmlUrl":55,"ownerBlogUrl":56,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M73FP7A4RC1Z8ZX243CM5B9R","securing-github-actions-workflows",null,"This skill covers hardening GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation. It addresses pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, protecting secrets from exfiltration, preventing script injection in workflow expressions, and implementing required reviewers for workflow changes.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fsecuring-github-actions-workflows\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fsecuring-github-actions-workflows\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: securing-github-actions-workflows\ndescription: 'This skill covers hardening GitHub Actions workflows against supply\n  chain attacks, credential theft, and privilege escalation. It addresses pinning\n  actions to SHA digests, minimizing GITHUB_TOKEN permissions, protecting secrets\n  from exfiltration, preventing script injection in workflow expressions, and implementing\n  required reviewers for workflow changes.\n\n  '\ndomain: cybersecurity\nsubdomain: devsecops\ntags:\n- devsecops\n- cicd\n- github-actions\n- supply-chain\n- workflow-security\n- secure-sdlc\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- GV.SC-07\n- ID.IM-04\n- PR.PS-04\nmitre_attack:\n- T1195\n- T1554\n- T1059.004\n- T1068\n- T1548\nsource: https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\nsource_commit: 04450304b12645cb2b974ab96d28c0664758a88d\n---\n\n# Securing GitHub Actions Workflows\n\n## When to Use\n\n- When GitHub Actions is the CI\u002FCD platform and workflows need hardening against supply chain attacks\n- When workflows handle secrets, deploy to production, or have elevated permissions\n- When preventing script injection via untrusted PR titles, branch names, or commit messages\n- When requiring audit trails and approval gates for workflow modifications\n- When third-party actions pose supply chain risk through mutable version tags\n\n**Do not use** for securing other CI\u002FCD platforms (see platform-specific hardening guides), for application vulnerability scanning (use SAST\u002FDAST), or for secret detection in code (use Gitleaks).\n\n## Prerequisites\n\n- GitHub repository with GitHub Actions enabled\n- GitHub organization admin access for organization-level settings\n- Understanding of GitHub Actions workflow syntax and events\n\n## Workflow\n\n### Step 1: Pin Actions to SHA Digests\n\n```yaml\n# INSECURE: Mutable tag can be overwritten by attacker\n- uses: actions\u002Fcheckout@v4\n\n# SECURE: Pinned to immutable SHA digest\n- uses: actions\u002Fcheckout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1\n\n# Use Dependabot to auto-update pinned SHAs\n# .github\u002Fdependabot.yml\nversion: 2\nupdates:\n  - package-ecosystem: \"github-actions\"\n    directory: \"\u002F\"\n    schedule:\n      interval: \"weekly\"\n    commit-message:\n      prefix: \"ci\"\n```\n\n### Step 2: Minimize GITHUB_TOKEN Permissions\n\n```yaml\n# Set restrictive default permissions at workflow level\nname: CI Pipeline\npermissions: {}  # Start with no permissions\n\non: [push, pull_request]\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read  # Only what's needed\n    steps:\n      - uses: actions\u002Fcheckout@b4ffde65f46336ab88eb53be808477a3936bae11\n\n  deploy:\n    runs-on: ubuntu-latest\n    needs: build\n    if: github.ref == 'refs\u002Fheads\u002Fmain'\n    permissions:\n      contents: read\n      deployments: write\n      id-token: write  # For OIDC-based cloud auth\n    steps:\n      - name: Deploy\n        run: echo \"deploying\"\n```\n\n### Step 3: Prevent Script Injection\n\n```yaml\n# VULNERABLE: User-controlled input in run step\n- run: echo \"PR title is ${{ github.event.pull_request.title }}\"\n\n# SECURE: Use environment variable (properly escaped by shell)\n- name: Process PR\n  env:\n    PR_TITLE: ${{ github.event.pull_request.title }}\n    PR_BODY: ${{ github.event.pull_request.body }}\n  run: |\n    echo \"PR title is ${PR_TITLE}\"\n    echo \"PR body is ${PR_BODY}\"\n\n# SECURE: Use actions\u002Fgithub-script for complex operations\n- uses: actions\u002Fgithub-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea\n  with:\n    script: |\n      const title = context.payload.pull_request.title;\n      console.log(`PR title: ${title}`);\n```\n\n### Step 4: Secure Fork Pull Request Handling\n\n```yaml\n# DANGEROUS: pull_request_target runs with base repo permissions\n# on: pull_request_target  # AVOID unless absolutely necessary\n\n# SAFE: pull_request runs in fork context with limited permissions\non:\n  pull_request:\n    branches: [main]\n\n# If pull_request_target is required, never checkout PR code:\non:\n  pull_request_target:\n    types: [labeled]\n\njobs:\n  safe-job:\n    if: contains(github.event.pull_request.labels.*.name, 'safe-to-test')\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n    steps:\n      # NEVER do: actions\u002Fcheckout with ref: ${{ github.event.pull_request.head.sha }}\n      - uses: actions\u002Fcheckout@b4ffde65f46336ab88eb53be808477a3936bae11\n        # This checks out the BASE branch, not the PR\n```\n\n### Step 5: Protect Secrets and Environment Variables\n\n```yaml\njobs:\n  deploy:\n    runs-on: ubuntu-latest\n    environment: production  # Requires approval\n    steps:\n      - name: Deploy with secret\n        env:\n          # Secrets are masked in logs automatically\n          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}\n        run: |\n          # Never echo secrets\n          # echo \"$DEPLOY_KEY\"  # BAD\n          deploy-tool --key-file \u003C(echo \"$DEPLOY_KEY\")\n\n      - name: Audit secret access\n        run: |\n          # Log that secret was used without exposing it\n          echo \"::notice::Deploy key accessed for production deployment\"\n```\n\n### Step 6: Implement Workflow Change Controls\n\n```yaml\n# Require CODEOWNERS approval for workflow changes\n# .github\u002FCODEOWNERS\n.github\u002Fworkflows\u002F @security-team @platform-team\n.github\u002Factions\u002F @security-team @platform-team\n\n# Organization settings:\n# 1. Settings > Actions > General > Fork PR policies\n#    - Require approval for first-time contributors\n#    - Require approval for all outside collaborators\n# 2. Settings > Actions > General > Workflow permissions\n#    - Read repository contents and packages permissions\n#    - Do NOT allow GitHub Actions to create and approve PRs\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| SHA Pinning | Referencing GitHub Actions by their immutable commit SHA instead of mutable version tags |\n| Script Injection | Attack where untrusted input (PR title, branch name) is interpolated into shell commands |\n| GITHUB_TOKEN | Automatically generated token with configurable permissions scoped to the current repository |\n| pull_request_target | Dangerous event trigger that runs in the base repo context with full permissions on fork PRs |\n| Environment Protection | GitHub feature requiring manual approval before jobs accessing an environment can run |\n| CODEOWNERS | File defining required reviewers for specific paths including workflow files |\n| OIDC Federation | Using GitHub's OIDC token to authenticate to cloud providers without storing long-lived credentials |\n\n## Tools & Systems\n\n- **Dependabot**: Automated dependency updater that keeps pinned action SHAs current\n- **StepSecurity Harden Runner**: GitHub Action that monitors and restricts outbound network calls from workflows\n- **actionlint**: Linter for GitHub Actions workflow files that detects security issues\n- **allstar**: GitHub App by OpenSSF that enforces security policies on repositories\n- **scorecard**: OpenSSF tool that evaluates supply chain security practices including CI\u002FCD\n\n## Common Scenarios\n\n### Scenario: Preventing Supply Chain Attack via Compromised Third-Party Action\n\n**Context**: A widely-used GitHub Action is compromised and its v3 tag is updated to include credential-stealing code. Repositories using `@v3` automatically pull the malicious version.\n\n**Approach**:\n1. Pin all actions to SHA digests immediately across all repositories\n2. Configure Dependabot for github-actions ecosystem to manage SHA updates\n3. Restrict GITHUB_TOKEN permissions so even compromised actions have minimal access\n4. Add StepSecurity harden-runner to detect anomalous outbound network calls\n5. Review all third-party actions and replace unnecessary ones with inline scripts\n6. Require CODEOWNERS approval for any changes to .github\u002Fworkflows\u002F\n\n**Pitfalls**: SHA pinning without Dependabot means missing legitimate security updates to actions. Overly restrictive permissions can break legitimate workflows. Using `pull_request_target` for label-based gating still exposes secrets if the workflow checks out PR code.\n\n## Output Format\n\n```\nGitHub Actions Security Audit\n================================\nRepository: org\u002Fweb-application\nDate: 2026-02-23\n\nWORKFLOW ANALYSIS:\n  Total workflows: 8\n  Total action references: 34\n\nSHA PINNING:\n  [FAIL] 12\u002F34 actions use mutable tags instead of SHA digests\n  - .github\u002Fworkflows\u002Fci.yml: actions\u002Fsetup-node@v4\n  - .github\u002Fworkflows\u002Fdeploy.yml: aws-actions\u002Fconfigure-aws-credentials@v4\n\nPERMISSIONS:\n  [FAIL] 3\u002F8 workflows have no explicit permissions (inherit default)\n  [WARN] 1\u002F8 workflows request write-all permissions\n\nSCRIPT INJECTION:\n  [FAIL] 2 workflow steps interpolate user input directly\n  - .github\u002Fworkflows\u002Fpr-check.yml:23: ${{ github.event.pull_request.title }}\n\nSECRETS:\n  [PASS] No secrets exposed in workflow logs\n  [PASS] All production deployments use environment protection\n\nSCORE: 6\u002F10 (Remediate 5 HIGH findings)\n```\n","# Securing GitHub Actions Workflows\n\n## When to Use\n\n- When GitHub Actions is the CI\u002FCD platform and workflows need hardening against supply chain attacks\n- When workflows handle secrets, deploy to production, or have elevated permissions\n- When preventing script injection via untrusted PR titles, branch names, or commit messages\n- When requiring audit trails and approval gates for workflow modifications\n- When third-party actions pose supply chain risk through mutable version tags\n\n**Do not use** for securing other CI\u002FCD platforms (see platform-specific hardening guides), for application vulnerability scanning (use SAST\u002FDAST), or for secret detection in code (use Gitleaks).\n\n## Prerequisites\n\n- GitHub repository with GitHub Actions enabled\n- GitHub organization admin access for organization-level settings\n- Understanding of GitHub Actions workflow syntax and events\n\n## Workflow\n\n### Step 1: Pin Actions to SHA Digests\n\n```yaml\n# INSECURE: Mutable tag can be overwritten by attacker\n- uses: actions\u002Fcheckout@v4\n\n# SECURE: Pinned to immutable SHA digest\n- uses: actions\u002Fcheckout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1\n\n# Use Dependabot to auto-update pinned SHAs\n# .github\u002Fdependabot.yml\nversion: 2\nupdates:\n  - package-ecosystem: \"github-actions\"\n    directory: \"\u002F\"\n    schedule:\n      interval: \"weekly\"\n    commit-message:\n      prefix: \"ci\"\n```\n\n### Step 2: Minimize GITHUB_TOKEN Permissions\n\n```yaml\n# Set restrictive default permissions at workflow level\nname: CI Pipeline\npermissions: {}  # Start with no permissions\n\non: [push, pull_request]\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read  # Only what's needed\n    steps:\n      - uses: actions\u002Fcheckout@b4ffde65f46336ab88eb53be808477a3936bae11\n\n  deploy:\n    runs-on: ubuntu-latest\n    needs: build\n    if: github.ref == 'refs\u002Fheads\u002Fmain'\n    permissions:\n      contents: read\n      deployments: write\n      id-token: write  # For OIDC-based cloud auth\n    steps:\n      - name: Deploy\n        run: echo \"deploying\"\n```\n\n### Step 3: Prevent Script Injection\n\n```yaml\n# VULNERABLE: User-controlled input in run step\n- run: echo \"PR title is ${{ github.event.pull_request.title }}\"\n\n# SECURE: Use environment variable (properly escaped by shell)\n- name: Process PR\n  env:\n    PR_TITLE: ${{ github.event.pull_request.title }}\n    PR_BODY: ${{ github.event.pull_request.body }}\n  run: |\n    echo \"PR title is ${PR_TITLE}\"\n    echo \"PR body is ${PR_BODY}\"\n\n# SECURE: Use actions\u002Fgithub-script for complex operations\n- uses: actions\u002Fgithub-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea\n  with:\n    script: |\n      const title = context.payload.pull_request.title;\n      console.log(`PR title: ${title}`);\n```\n\n### Step 4: Secure Fork Pull Request Handling\n\n```yaml\n# DANGEROUS: pull_request_target runs with base repo permissions\n# on: pull_request_target  # AVOID unless absolutely necessary\n\n# SAFE: pull_request runs in fork context with limited permissions\non:\n  pull_request:\n    branches: [main]\n\n# If pull_request_target is required, never checkout PR code:\non:\n  pull_request_target:\n    types: [labeled]\n\njobs:\n  safe-job:\n    if: contains(github.event.pull_request.labels.*.name, 'safe-to-test')\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n    steps:\n      # NEVER do: actions\u002Fcheckout with ref: ${{ github.event.pull_request.head.sha }}\n      - uses: actions\u002Fcheckout@b4ffde65f46336ab88eb53be808477a3936bae11\n        # This checks out the BASE branch, not the PR\n```\n\n### Step 5: Protect Secrets and Environment Variables\n\n```yaml\njobs:\n  deploy:\n    runs-on: ubuntu-latest\n    environment: production  # Requires approval\n    steps:\n      - name: Deploy with secret\n        env:\n          # Secrets are masked in logs automatically\n          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}\n        run: |\n          # Never echo secrets\n          # echo \"$DEPLOY_KEY\"  # BAD\n          deploy-tool --key-file \u003C(echo \"$DEPLOY_KEY\")\n\n      - name: Audit secret access\n        run: |\n          # Log that secret was used without exposing it\n          echo \"::notice::Deploy key accessed for production deployment\"\n```\n\n### Step 6: Implement Workflow Change Controls\n\n```yaml\n# Require CODEOWNERS approval for workflow changes\n# .github\u002FCODEOWNERS\n.github\u002Fworkflows\u002F @security-team @platform-team\n.github\u002Factions\u002F @security-team @platform-team\n\n# Organization settings:\n# 1. Settings > Actions > General > Fork PR policies\n#    - Require approval for first-time contributors\n#    - Require approval for all outside collaborators\n# 2. Settings > Actions > General > Workflow permissions\n#    - Read repository contents and packages permissions\n#    - Do NOT allow GitHub Actions to create and approve PRs\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| SHA Pinning | Referencing GitHub Actions by their immutable commit SHA instead of mutable version tags |\n| Script Injection | Attack where untrusted input (PR title, branch name) is interpolated into shell commands |\n| GITHUB_TOKEN | Automatically generated token with configurable permissions scoped to the current repository |\n| pull_request_target | Dangerous event trigger that runs in the base repo context with full permissions on fork PRs |\n| Environment Protection | GitHub feature requiring manual approval before jobs accessing an environment can run |\n| CODEOWNERS | File defining required reviewers for specific paths including workflow files |\n| OIDC Federation | Using GitHub's OIDC token to authenticate to cloud providers without storing long-lived credentials |\n\n## Tools & Systems\n\n- **Dependabot**: Automated dependency updater that keeps pinned action SHAs current\n- **StepSecurity Harden Runner**: GitHub Action that monitors and restricts outbound network calls from workflows\n- **actionlint**: Linter for GitHub Actions workflow files that detects security issues\n- **allstar**: GitHub App by OpenSSF that enforces security policies on repositories\n- **scorecard**: OpenSSF tool that evaluates supply chain security practices including CI\u002FCD\n\n## Common Scenarios\n\n### Scenario: Preventing Supply Chain Attack via Compromised Third-Party Action\n\n**Context**: A widely-used GitHub Action is compromised and its v3 tag is updated to include credential-stealing code. Repositories using `@v3` automatically pull the malicious version.\n\n**Approach**:\n1. Pin all actions to SHA digests immediately across all repositories\n2. Configure Dependabot for github-actions ecosystem to manage SHA updates\n3. Restrict GITHUB_TOKEN permissions so even compromised actions have minimal access\n4. Add StepSecurity harden-runner to detect anomalous outbound network calls\n5. Review all third-party actions and replace unnecessary ones with inline scripts\n6. Require CODEOWNERS approval for any changes to .github\u002Fworkflows\u002F\n\n**Pitfalls**: SHA pinning without Dependabot means missing legitimate security updates to actions. Overly restrictive permissions can break legitimate workflows. Using `pull_request_target` for label-based gating still exposes secrets if the workflow checks out PR code.\n\n## Output Format\n\n```\nGitHub Actions Security Audit\n================================\nRepository: org\u002Fweb-application\nDate: 2026-02-23\n\nWORKFLOW ANALYSIS:\n  Total workflows: 8\n  Total action references: 34\n\nSHA PINNING:\n  [FAIL] 12\u002F34 actions use mutable tags instead of SHA digests\n  - .github\u002Fworkflows\u002Fci.yml: actions\u002Fsetup-node@v4\n  - .github\u002Fworkflows\u002Fdeploy.yml: aws-actions\u002Fconfigure-aws-credentials@v4\n\nPERMISSIONS:\n  [FAIL] 3\u002F8 workflows have no explicit permissions (inherit default)\n  [WARN] 1\u002F8 workflows request write-all permissions\n\nSCRIPT INJECTION:\n  [FAIL] 2 workflow steps interpolate user input directly\n  - .github\u002Fworkflows\u002Fpr-check.yml:23: ${{ github.event.pull_request.title }}\n\nSECRETS:\n  [PASS] No secrets exposed in workflow logs\n  [PASS] All production deployments use environment protection\n\nSCORE: 6\u002F10 (Remediate 5 HIGH findings)\n```\n",{"name":5,"tags":25,"author":32,"domain":33,"source":34,"license":15,"version":35,"nist_csf":36,"subdomain":26,"description":41,"mitre_attack":42,"source_commit":48},[26,27,28,29,30,31],"devsecops","cicd","github-actions","supply-chain","workflow-security","secure-sdlc","mahipal","cybersecurity","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","1.0.0",[37,38,39,40],"PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04","This skill covers hardening GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation. It addresses pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, protecting secrets from exfiltration, preventing script injection in workflow expressions, and implementing required reviewers for workflow changes.\n",[43,44,45,46,47],"T1195","T1554","T1059.004","T1068","T1548","04450304b12645cb2b974ab96d28c0664758a88d","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Fsecuring-github-actions-workflows",1,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-11 23:56:26",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill securing-github-actions-workflows",{"tool":65,"command":66},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill securing-github-actions-workflows",{"tool":68,"command":69},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill securing-github-actions-workflows","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fsecuring-github-actions-workflows\u002FSKILL.md",true,[73,79,83,89,93,97,103],{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"assets\u002Ftemplate.md","ASSET","资产文件",1016,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fsecuring-github-actions-workflows\u002Fassets\u002Ftemplate.md",{"path":80,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fapi-reference.md","REFERENCE","参考文档",1844,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fsecuring-github-actions-workflows\u002Freferences\u002Fapi-reference.md",{"path":90,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fstandards.md",1152,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fsecuring-github-actions-workflows\u002Freferences\u002Fstandards.md",{"path":94,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fworkflows.md",1192,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fsecuring-github-actions-workflows\u002Freferences\u002Fworkflows.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",8248,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fsecuring-github-actions-workflows\u002Fscripts\u002Fagent.py",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fprocess.py",7533,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fsecuring-github-actions-workflows\u002Fscripts\u002Fprocess.py",[108,116,123,131,139,147],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":20},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":20},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":127,"sourceHtmlUrl":128,"categories":129,"keywords":130,"publishedAt":20},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":135,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":20},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":143,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":20},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":148,"name":149,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":152,"publishedAt":20},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]