Prompt Buddy logoPrompt Buddy

github · GitHub Actions Docs

Actions Script injections - GitHub Docs

Explains how script injection vulnerabilities occur in GitHub Actions workflows and provides guidance on preventing them by sanitizing inputs and avoiding unsafe patterns.

Import to Prompt Buddy

Derived skill

Files assembled from official documentation

Viewing SKILL.md

Actions Script injections - GitHub Docs

Explains how script injection vulnerabilities occur in GitHub Actions workflows and provides guidance on preventing them by sanitizing inputs and avoiding unsafe patterns.

When To Use

Use when you need to secure GitHub Actions workflows against malicious input or prevent command injection during script execution.

Reference Files

FileContainsUse For
SKILL.mdEntry point: scope, routing table, and workflow.Start here.
docs/actions-security-script-injections-github-docs-workflow-guide.mdA guide explaining the security risks and attack vectors associated with script injections in GitHub Actions workflows.Questions about a guide explaining the security risks and attack vectors associated with script injections in GitHub Actions workflows.
examples/actions-security-script-injections-github-docs-github-actions-script-inj.textA YAML workflow snippet demonstrating a security vulnerability where a pull request title is directly injected into a shell script.Exact payloads, commands, or snippets shown in A YAML workflow snippet demonstrating a security vulnerability where a pull request title is directly injected into a...
examples/actions-security-script-injections-github-docs-github-actions-script-inj-2.textA text representation of a GitHub Actions workflow and script demonstrating potential script injection vulnerabilities.Exact payloads, commands, or snippets shown in A text representation of a GitHub Actions workflow and script demonstrating potential script injection vulnerabilities.

What This Skill Covers

    • GitHub Actions / - Concepts / - Security / - Script injections
  • Main sections: Understanding the risk of script injections, Example of a script injection attack.

Workflow

  1. Open the most relevant file under docs/ for the exact documented workflow and wording.
  2. Open schemas/ files for exact structured contracts.
  3. Open examples/ files for concrete requests, commands, snippets, and manifests.
  4. Do not add behavior or configuration that is not present in the attached source files.

Canonical source: https://docs.github.com/en/actions/concepts/security/script-injections