ci: add automated skill review for SKILL.md pull requests#2320
ci: add automated skill review for SKILL.md pull requests#2320Alan Pope (popey) wants to merge 1 commit intolangchain-ai:mainfrom
Conversation
Adds a lightweight GitHub Action that reviews any SKILL.md files changed in a pull request using tessl skill review. Posts results as a PR comment with minimal permissions (pull-requests: write, contents: read). Signed-off-by: Alan Pope <alan@popey.com>
|
This PR has been automatically closed because it does not link to an approved issue. All external contributions must reference an approved issue or discussion. Please:
Maintainers: reopen this PR or remove the |
There was a problem hiding this comment.
Security Issues
- Unpinned Third-Party GitHub Action (Supply Chain Risk)
The workflow uses a third-party action via a moving branch referencetesslio/skill-review@main. If that repository is compromised or its main branch changes, arbitrary code will execute in your CI with the grantedGITHUB_TOKENpermissions (pull-requests: write,contents: read). This is a realistic and exploitable supply chain vector.
Recommendations
- Pin the third-party action to a specific commit SHA to provide integrity and immutability guarantees.
- Keep the token scope to the minimum necessary; using an unpinned third-party action with write permissions increases potential impact if the action is compromised.
| contents: read | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: tesslio/skill-review@main |
There was a problem hiding this comment.
Using a third-party GitHub Action via a moving branch reference is a supply chain risk. If tesslio/skill-review's main branch is modified or compromised, it can execute arbitrary code in your workflow with the provided GITHUB_TOKEN permissions (pull-requests: write, contents: read). This is exploitable on any PR that matches the path filter.
Vulnerable line:
- uses: tesslio/skill-review@mainImpact:
- Arbitrary code execution on the CI runner by an external repository.
- Ability to exfiltrate the
GITHUB_TOKENand perform write operations on pull requests (e.g., post or alter reviews/comments, modify PR metadata).
Remediation:
- Pin the action to a specific commit SHA (e.g.,
tesslio/skill-review@<commit-sha>). Regularly review and update the pinned SHA as needed. - Ensure permissions are least-privilege for the required functionality.
For more details, see the finding in Corridor.
Provide feedback: Reply with whether this is a valid vulnerability or false positive to help improve Corridor's accuracy.
Hullo! Thanks for merging the skill improvements earlier. This is a follow-up that adds a lightweight GitHub Action to automatically review any
SKILL.mdfiles when they're changed in a PR, using tessl skill review.**/SKILL.mdpull-requests: writeandcontents: readThis way you and your contributors get an instant quality signal on skill changes before manual review — no signup or tokens needed.