workflow-audit

Included with Lifetime

$97 forever

Run the Bitwarden workflow linter (bwwl) against one or more repos and report findings. Strictly read-only — does not modify any files. Categorizes findings as mechanical or judgment using the bitwarden-workflow-linter-rules skill. Supports single repo, multiple repos, or single file/directory scope. <example> User: Run the workflow linter on the server repo Action: Trigger workflow-audit for that repo </example> <example> User: Lint the workflows across server, clients, and android Action: Trigger workflow-audit in multi-repo mode </example>

Security

What this skill does


## Rules

- **This skill is strictly read-only.** Do not modify, create, or delete any files.
- **Flag uncertainty.** If a finding is ambiguous, note it in the report rather than guessing.

## Step 1: Verify Prerequisites

Check if `bwwl` is available:

```bash
bwwl --version
```

If the command is not found, stop and inform the user that `bwwl` must be installed before continuing. Do not attempt to install it.

## Step 2: Determine Scope

Parse the user's request to determine what to lint:

- **Single file or directory** (e.g., `.github/workflows/build.yml` or `.github/workflows/`): Operate on the current repo only.
- **Multiple repos** (e.g., "server, clients, android"): Operate on each repo sequentially. Ask the user for the base directory where their repos are cloned. For each repo, look for its local clone at `<base-dir>/<repo>`. If a clone is not found, inform the user and skip that repo.
- **No specific target**: Lint all files in `.github/workflows/` of the current directory.

## Step 3: Run the Linter

For each repo in scope, run:

```bash
bwwl lint -f .github/workflows/
```

Capture both stdout and stderr. If operating on multiple repos, announce which repo is being linted.

## Step 4: Parse and Categorize Findings

From the linter output, produce a structured list of findings. Group by file and rule. Consult the `bitwarden-workflow-linter-rules` skill to categorize each finding:

**Mechanical** (can be auto-fixed):

- `name_capitalized`, `permissions_exist`, `pinned_job_runner`, `step_pinned`, `underscore_outputs`, `job_environment_prefix`, `check_pr_target`
- Simple `run_actionlint` findings (single-line shell fixes)

**Judgment** (requires user input):

- `name_exists`, `step_approved`, complex `run_actionlint` findings

## Step 5: Report

Output a summary table per repo:

| File | Finding | Rule | Category |
| ---- | ------- | ---- | -------- |
| ...  | ...     | ...  | ...      |

Include totals: mechanical findings, judgment findings, and repos with no issues.

Inform the user that they can use the `workflow-fix` skill to apply fixes based on these findings.

Files: 1

Size: 2.7 KB

Complexity: 16/100

Category: Security

Source: https://github.com/bitwarden/ai-plugins/tree/main/plugins/bitwarden-devops-engineer/skills/workflow-audit

Related in Security

mac-ops

Included

Comprehensive macOS workstation operations — diagnose kernel panics, identify failing drives, audit launchd startup items, decode wake reasons, triage TCC permission denials, manage APFS snapshots, recover from no-boot. Use for: Mac is slow, slow bootup, won't boot, kernel panic, kernel_task hot, mds_stores CPU, photoanalysisd, cloudd, login loop, gray screen, sleep wake failure, drive failing, IO errors, APFS snapshots eating space, Time Machine local snapshots, Spotlight indexing, launchd, LaunchAgent, LaunchDaemon, login items, TCC permissions, Full Disk Access, Screen Recording denied, Gatekeeper, quarantine, com.apple.quarantine, app is damaged, helper tool, /Library/PrivilegedHelperTools, pmset, wake reasons, dark wake, sysdiagnose, panic.ips, DiagnosticReports, configuration profile, MDM profile, remote diagnostics over SSH.

Securityscripts

a11y-audit

Included

Run accessibility audits on web projects combining automated scanning (axe-core, Lighthouse) with WCAG 2.1 AA compliance mapping, manual check guidance, and structured reporting. Output is configurable: markdown report only, markdown plus machine-readable JSON, or markdown plus issue tracker integration. Use this skill whenever the user mentions "accessibility audit", "a11y audit", "WCAG audit", "accessibility check", "compliance scan", or asks to check a web project for accessibility issues. Also trigger when the user wants to verify WCAG conformance or map findings to a specific standard (CAN-ASC-6.2, EN 301 549, ADA/AODA).

Securityscripts

erpclaw

Included

AI-native ERP system with self-extending OS. Full accounting, invoicing, inventory, purchasing, tax, billing, HR, payroll, advanced accounting (ASC 606/842, intercompany, consolidation), and financial reporting. 413 actions across 14 domains, 43 expansion modules. Constitutional guardrails, adversarial audit, schema migration. Double-entry GL, immutable audit trail, US GAAP.

Securityscripts

assess

Included

Assesses and rates quality 0-10 across multiple dimensions (correctness, maintainability, security, performance, testability, simplicity) with pros/cons analysis. Compares against project conventions and prior decisions from memory. Produces structured evaluation reports with actionable improvement suggestions. Use when evaluating code, designs, architectures, or comparing alternative approaches.

Securityscripts

spring-boot-security-jwt

Included

Provides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based access control using Spring Security 6.x. Use when implementing authentication or authorization in Spring Boot applications.

Securityscripts

code-hardcode-audit

Included

Detect hardcoded values, magic numbers, and leaked secrets. TRIGGERS - hardcode audit, magic numbers, PLR2004, secret scanning.

Securityscripts

Detect hardcoded values, magic numbers, and leaked secrets. TRIGGERS - hardcode audit, magic numbers, PLR2004, secret scanning.

Securityscripts