Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it.
AI-powered evaluation of trust, security posture, quality signals, and fit for your use case. Grounded in the skill's actual data.
Detected signals: hidden HTML comments, missing license.
• Contains HTML comments in the skill definition. This is sometimes used to embed hidden instructions. Review the raw SKILL.md if you want to audit the full content.
• No license declared. Usage rights are ambiguous — contact the skill author before using commercially.
Compare this skill side-by-side with an alternative to find the best fit.
Compare with another skill →