[Skill] Github security audit

[arielkr256]

Use when the user asks to audit GitHub Actions workflows for security vulnerabilities, supply chain risks, script injection, dangerous triggers, or attack vectors from the Wiz GitHub Actions threat model. Triggers on requests like "check my GitHub Actions for vulnerabilities", "audit workflows for pwn requests", "scan for script injection in workflows", "check if actions are pinned to commit SHAs", or "audit all public repos for GitHub Actions issues".

[cursor]

PR Summary

Low Risk
Adds documentation-style skill configuration only; no runtime, auth, or workflow execution changes in this repo.

Overview
Adds a new Panther AI skill github_actions_security_audit_skill that guides automated audits of GitHub Actions workflows against the Wiz threat model.

The skill prompt walks through optional org-wide repo discovery via git_hub_search_repositories, workflow discovery with git_hub_get_file_contents / git_hub_search_code, and checks for dangerous triggers (e.g. pwn-request patterns with pull_request_target), script injection in run: blocks, and unpinned third-party actions. It ends with a structured report template (summary table, detailed findings, remediation, overall risk posture).

Metadata wires RequiredTools to the three GitHub MCP tools above, plus tags for github, supply-chain, ci-cd, and security-audit.

^{Reviewed by Cursor Bugbot for commit 32036ab. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 32036ab. Configure here.}

[cursor]

Step zero lacks org identity

Medium Severity

Step 0 requires org:<org-name> or user:<username> in git_hub_search_repositories but never says how to obtain that target when the user did not name a repository or organization, so discovery can stall or guess wrong.

 

^{Reviewed by Cursor Bugbot for commit 32036ab. Configure here.}

[cursor]

Multi-repo report timing unclear

Medium Severity

Step 0 loops Steps 1–4 per discovered repo but never states that Step 5 runs once after all repos. Step 5’s “Total repositories scanned” implies one combined report, so agents may emit partial reports or wrong totals.

Additional Locations (1)

• skills/panther_ai_github_actions_security_audit_skill.yml#L166-L193

 

^{Reviewed by Cursor Bugbot for commit 32036ab. Configure here.}

[cursor]

Search tip omits yaml extension

Low Severity

Step 1’s git_hub_search_code example uses extension:yml only, while Step 1 also expects .yaml workflow files, so code search may miss workflows that use the .yaml suffix.

 

^{Reviewed by Cursor Bugbot for commit 32036ab. Configure here.}