Help us improve
Share bugs, ideas, or general feedback.
From infra-review
Use when reviewing, auditing, or improving GitHub Actions workflows in a repository — checks for version drift, permission issues, missing concurrency controls, path filter gaps, and cross-workflow inconsistencies
npx claudepluginhub infraspecdev/tesseract --plugin infra-reviewHow this skill is triggered — by the user, by Claude, or both
Slash command
/infra-review:github-actions-reviewerThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Structured review of GitHub Actions workflows for consistency, security, and operational best practices.
Reviews GitHub Actions workflows for supply chain risks: enforces SHA pinning, rates third-party actions, scopes permissions, checks triggers and inputs, and recommends updates.
Writes and optimizes GitHub Actions workflows for CI/CD pipelines, triggers, jobs, steps, secrets, artifacts, and debugging runs.
Checks and configures GitHub Actions CI/CD workflows for container builds, tests, and releases. Updates action versions, adds caching, multi-platform builds, and audits missing workflows.
Share bugs, ideas, or general feedback.
Structured review of GitHub Actions workflows for consistency, security, and operational best practices.
Core principle: Workflows in the same repo form a system. Review them as a group, not individually — inconsistencies between workflows cause the hardest-to-debug CI failures.
Read All Workflows + Config -> Evaluate Against Checklist -> Write analysis.md -> Write plan.md -> Ask User to Confirm -> (proceed: Execute / stop: Done / edit: revise plan.md)
Read every file in .github/workflows/ plus related config: release tooling configs (release-please-config.json, .releaserc.json, etc.), versions.tf, .tflint.hcl, package.json.
Run through the 8-point checklist covering version consistency, plugin/config alignment, permissions, concurrency control, path filters, reusable patterns, action pinning, and secrets handling. See checklist.md for detailed criteria, examples, and red flags.
Write findings, checklist results, and a letter grade (A-F) to claude/github-actions-review/analysis.md in the target repo. See templates.md for the full template.
Write actionable implementation steps (or confirm no changes needed) to claude/github-actions-review/plan.md. See templates.md for the full template.
Present: "I've written the analysis (Grade: X) and plan (Y steps). Would you like me to proceed, stop here, or wait while you edit plan.md?"
For each plan step: announce it, execute, show what changed, update verification checkboxes in plan.md, and confirm before moving to the next step. Stop and ask for input if anything fails.
| Mistake | Why It Fails | Do Instead |
|---|---|---|
| Reviewing workflows individually | Misses cross-workflow inconsistencies (version drift, permission gaps) | Always read all workflows before evaluating any |
| Skipping file output on re-review | User loses the updated analysis and grade | Always write fresh analysis.md and plan.md |
| Auto-executing the plan | User hasn't reviewed or approved changes | Always ask for confirmation first |
| Ignoring release tooling config | Plugin mismatches between preview and release workflows go undetected | Read .releaserc.json, release-please-config.json, etc. |
| Checking only permissions at workflow level | Job-level permissions override workflow-level | Check both levels |