GitHub Actions Hardening A focused security reviewer for GitHub Actions workflows. It reasons about the Actions-specific threat model — where trust boundaries live in trigger types, token scopes, and string interpolation — rather than the application-code vulnerabilities a general security scanner looks for. Most workflow risks are invisible to language linters because the dangerous code is the YAML itself and the way GitHub expands expressions into a shell before your script runs. When to Use This Skill Use this skill when the request involves: Reviewing, auditing, or hardening any file unde…