Comprehensive hardening steps for self-hosted GitHub Actions runners. OS-level security, network isolation, credential protection, and audit logging.
Provides comprehensive hardening for self-hosted GitHub Actions runners. Claude will use this when you need to secure OS-level settings, isolate networks, protect credentials, and implement audit logging for runner infrastructure.
/plugin marketplace add adaptive-enforcement-lab/claude-skills/plugin install secure@ael-skillsThis skill inherits all available tools. When active, it can use any tool Claude has access to.
examples.mdreference.mdscripts/example-1.mermaidscripts/example-10.shscripts/example-2.shscripts/example-3.shscripts/example-4.shscripts/example-5.shscripts/example-6.shscripts/example-7.shscripts/example-8.shscripts/example-9.shHardening is not optional. Every layer of defense you skip is an attack vector you gift to adversaries. Deploy runners defensively or accept the breach.
The Default Is Insecure
A default runner installation has root access, unrestricted network, cloud metadata endpoints, persistent filesystem, and ambient credentials. One malicious workflow means full infrastructure compromise. Apply every hardening layer.
See the full implementation guide in the source documentation.
See examples.md for code examples.
See reference.md for complete documentation.
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.