actions-workflow-hardenerlisted

# actions-workflow-hardener A Category 3 ops tool. The user runs this against a workflow YAML file — either pasted into the conversation or pointed at by path — and gets a prioritized finding list with concrete remediation. The skill's checks come directly from the 7 hardening practices documented in [[2026-06-20-actions-hardening-post-shai-hulud]]. As that research note is updated (new attack techniques, new GitHub guidance), the checks here update with it. ## When to use - Reviewing a new workflow before merge. - Auditing an inherited workflow during repo onboarding. - Periodic sweep across org-wide workflows when planning a hardening campaign. - Validating that an existing workflow's `permissions:` block is sane after a refactor. ## When NOT to use - Pure correctness review (does the workflow work) — that's not this skill's scope. - Performance optimization — separate concern. - Repo-level governance (CODEOWNERS, branch protection) — that's [`repo-golden-path-scorer`](../repo-golden-path-scorer/SKILL.md). - Org-wide GHAS settings — that's `ghas-config-reviewer`. ## Checks Each check produces a finding object: `{check_id, severity, line, snippet, message, remediation, reference}`. ### `ATH-001` — Missing top-level `permissions:` block (HIGH) If the workflow file has no top-level `permissions:` declaration AND no per-job declarations, GITHUB_TOKEN defaults to the org-wide default (often `write-all`). Recommend adding a top-level `permissions: contents: read` and es