GitHub Actions Secret Exposure Audit

Use this skill to catch risky secret handling patterns in workflow YAML before they leak credentials or allow unsafe token use.

What this skill does

• - Scans workflow YAML files (.github/workflows/*.yml by default)
• Flags pull_request_target workflows that also reference INLINECODE2
• Flags shell output commands that print secret expressions (echo, printf, tee, ::set-output)
• Flags secret values passed into unpinned third-party actions (@main, @master, @v1, etc.)
• Flags likely hardcoded credential values in workflow config
• Supports text/json output and CI fail gate

Inputs

• - WORKFLOW_GLOB (default: .github/workflows/*.y*ml)
• INLINECODE12 (default: 20)
• INLINECODE14 (text or json, default: text)
• INLINECODE18 (default: 4)
• INLINECODE20 (default: 8)
• INLINECODE22 / WORKFLOW_FILE_EXCLUDE (regex, optional)
• INLINECODE24 (regex, optional) — allow listed action refs (for example ^v1\.2\.3$)
• INLINECODE26 (0 or 1, default: 0)

Run

Text report:

CODEBLOCK0

JSON output + fail gate:

CODEBLOCK1

Run against bundled fixtures:

CODEBLOCK2

Output contract

• - Exit 0 in reporting mode (default)
• Exit 1 when FAIL_ON_CRITICAL=1 and one or more workflows are critical
• Text mode prints summary + top risky workflows
• JSON mode prints summary + ranked workflows + critical workflows