GitHub-Actions-Sicherheitsüberprüfung auf Workflow-Exploit-Schwachstellen. Wird verwendet, wenn Sie aufgefordert werden, „GitHub Actions zu überprüfen“, „Workflows zu auditieren“, „CI-Sicherheit zu prüfen“, „GHA-Sicherheit“ oder „Workflow-Sicherheitsüberprüfung“ durchzuführen oder .github/workflows/ auf Pwn-Anfragen, Ausdrucksinjektion, Anmeldedatendiebstahl und Supply-Chain-Angriffe zu untersuchen. Exploitationsorientiert mit konkreten PoC-Szenarien.
Der Skill `getsentry/gha-security-review` ist ein spezialisiertes Werkzeug für Entwickler und Sicherheitsexperten, die GitHub Actions Workflows auf Sicherheitslücken untersuchen möchten. Der Fokus liegt auf der Identifizierung und Demonstration von Exploit-Szenarien, wie Pwn-Anfragen (Request Smuggling), Ausdrucksinjektion (Expression Injection), Anmeldedatendiebstahl und Supply-Chain-Angriffen. Anstatt nur theoretische Schwachstellen aufzulisten, liefert dieser Skill konkrete Proof-of-Concept (PoC)-Szenarien, die die tatsächliche Ausbeutung einer Sicherheitslücke demonstrieren. Er ist ideal, wenn Sie eine Auditanfrage wie „Überprüfe meine GitHub Actions“ oder „Ist mein CI sicher?“ erhalten, und analysiert die YAML-Dateien in `.github/workflows/`. Der Skill ist primär für den Einsatz mit KI-Agenten wie Claude Code, Cursor oder Codex konzipiert, die Workflow-Dateien lesen und analysieren können. Er hilft, Schwachstellen zu identifizieren, die in CI/CD-Pipelines unbeabsichtigt Angriffsflächen schaffen könnten. Die Unterstützung umfasst gängige Plattformen, die mit GitHub-Repositorys arbeiten, und setzt auf eine praxisnahe, sicherheitsorientierte Perspektive.
npx skills add https://github.com/getsentry/skills/tree/main/skills/gha-security-reviewInstalled? Explore more Produktivität & Zusammenarbeit skills: steipete/gemini, steipete/gh-issues, steipete/skill-creator · View all 6 →
GitHub-Actions-Sicherheitsüberprüfung auf Workflow-Exploit-Schwachstellen. Verwenden Sie dies, wenn Sie aufgefordert werden, „GitHub Actions zu überprüfen“, „Workflows zu auditieren“, „CI-Sicherheit zu prüfen“, „GHA-Sicherheit“ oder „Workflow-Sicherheitsüberprüfung“ durchzuführen oder .github/workflows/ auf Pwn-Anfragen, Ausdrucksinjektion, Anmeldedatendiebstahl und Supply-Chain-Angriffe zu untersuchen. Exploitationsorientiert mit konkreten PoC-Szenarien.
This repo contains 20 individual skills — each has its own dedicated page.
Creates and maintains concise AGENTS.md and CLAUDE.md project instruction files. Use when asked to create AGENTS.md, update AGENTS.md, maintain agent docs, set up CLAUDE.md, document repository agent conventions, or keep coding-agent instructions minimal and reference-backed.
Write, review, and improve blog posts for the Sentry engineering blog following Sentry's specific writing standards, voice, and quality bar. Use this skill whenever someone asks to write a blog post, draft a technical article, review blog content, improve a draft, write a product announcement, create an engineering deep-dive, or produce any written content destined for the Sentry blog or developer audience. Also trigger when the user mentions "blog post," "blog draft," "write-up," "announcement post," "engineering post," "deep dive," "postmortem," or asks for help with technical writing for Sentry. Even if the user just says "help me write about [feature/topic]" — if it sounds like it could become a Sentry blog post, use this skill.
Write copy following Sentry brand guidelines. Use when writing UI text, error messages, empty states, onboarding flows, 404 pages, documentation, marketing copy, or any user-facing content. Covers both Plain Speech (default) and Sentry Voice tones.
Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure.
Simplifies and refines code for clarity, consistency, and maintainability while preserving all functionality. Use when asked to "simplify code", "clean up code", "refactor for clarity", "improve readability", or review recently modified code for elegance. Focuses on project-specific best practices.
ALWAYS use this skill when committing code changes — never commit directly without it. Creates commits following Sentry conventions with proper conventional commit format and issue references. Trigger on any commit, git commit, save changes, or commit message task.
Create a git branch following Sentry naming conventions. Use when asked to "create a branch", "new branch", "start a branch", "make a branch", "switch to a new branch", or when starting new work on the default branch.
Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access".
Django performance code review. Use when asked to "review Django performance", "find N+1 queries", "optimize Django", "check queryset performance", "database performance", "Django ORM issues", or audit Django code for performance problems.
Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers. Trigger when user mentions writing docs, creating proposals, drafting specs, or similar documentation tasks.
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
Fetch unread GitHub notifications for open PRs where review is requested from a specified team or opened by a team member. Use when asked to "find PRs I need to review", "show my review requests", "what needs my review", "fetch GitHub review requests", or "check team review queue".
Iterate on a PR until actionable CI passes and high/medium review feedback is addressed. Use for PR CI failures, review feedback, or green-check loops; do not wait for human approval, draft status, or merge gates.
Create data-driven presentation slides using React, Vite, and Recharts with Sentry branding. Use when asked to "create a presentation", "build slides", "make a deck", "create a data presentation", "build a Sentry presentation". Scaffolds a complete slide-based app with charts, animations, and single-file HTML output.
Create, refresh, and rewrite PR titles and descriptions following Sentry conventions. Use when opening a PR, writing or updating a PR title/body/description, refreshing an existing PR after material changes, or preparing branch changes for review.
Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.
Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whether an agent skill is safe to install. Checks for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.
Create, synthesize, and iteratively improve agent skills following the Agent Skills specification. Use when asked to "create a skill", "write a skill", "synthesize sources into a skill", "improve a skill from positive/negative examples", "update a skill", or "maintain skill docs and registration". Handles source capture, precision passes, authoring, registration, and validation.
Take a list of projects and their related documentation, and organize them into the SRED format for submission.
Go back through the previous year of work and create a Notion doc that groups relevant links into projects that can then be documented as SRED projects.
Gemini CLI one-shot prompts, summaries, generation, skills, hooks, MCP, or Gemma routing.
Fetch GitHub issues, select candidates, spawn background fix agents, open PRs, and optionally process PR review comments.
Create, edit, audit, tidy, validate, or restructure AgentSkills and SKILL.md files.
Search, install, update, sync, or publish agent skills with the ClawHub CLI and registry.
Delegate coding work to Codex, Claude Code, or OpenCode as background workers; not simple edits or read-only code lookup.
List, configure, authenticate, call, and inspect MCP servers/tools with mcporter over HTTP or stdio.