Secure workflow guide
Hardening CI: pinned actions, scoped tokens, and the injection paths in a pull_request_target trigger.
Installation
$ npx skills add trailofbits/skillsThe CLI's unit is the repository, so this installs everything in trailofbits/skills, not secure-workflow-guide alone. It writes into whichever agent directories it finds — Claude Code, Codex, Cursor, Copilot, Windsurf, Zed.
Summary
Hardening CI: pinned actions, scoped tokens, and the injection paths in a pull_request_target trigger.
- Reach for it when any workflow that runs against a fork's code or holds a token worth stealing.
- Spans Secure and Ship, so it is usually worth loading for the whole piece of work rather than at one moment in it.
- Assumes ci/cd.
- Published by Trail of Bits. Well regarded, but not the vendor of the thing it covers.
- Installing pulls the whole trailofbits/skills repository: this catalogue lists 12 other entries from it, and the repo may hold more.
Where it sits in delivery
SecureThreat modelling, scanning, supply chain, and finding the other five copies of the bug you just found.Everything in Secure →
ShipBranches, pipelines, releases and the deploy itself.Everything in Ship →
The skill itself
The full text lives with its publisher and changes when they change it. Read it there rather than here — a mirrored copy of somebody else's procedure goes stale silently, and this page would have no way of telling you.
Related
More in Secure
- Authoring GitHub workflowsWriting Actions workflows, from a team that maintains some very large ones.
dotnet/skills - EAS workflowsExpo Application Services build, submit and update pipelines, from Expo.
expo/skills - Security best practicesOpenAI's secure-coding guidance for agent-written code.
openai/skills - Supabase Postgres best practicesSchema, indexing and row-level security as Supabase recommends them.
supabase/agent-skills - CI/CD & automationPipeline structure, caching, matrix builds and gating.
addyosmani/agent-skills - Finishing a development branchThe end-of-branch checklist: rebase, squash, description, and what must be true before it merges.
obra/superpowers