Workflow Audit
- 47 installs
- 129 repo stars
- Updated August 4, 2026
- bitwarden/ai-plugins
workflow-audit is a Claude Code skill that runs the Bitwarden workflow linter (bwwl) against GitHub Actions workflow files and reports findings without modifying them.
About
This skill runs the Bitwarden workflow linter (bwwl) against GitHub Actions workflow files in one or more repositories and reports what it finds. It is read-only and does not change any files. A developer uses it to audit .github/workflows/ for lint rule violations, then categorizes each finding as mechanical or judgment so the workflow-fix skill can apply corrections.
- Runs the Bitwarden workflow linter (bwwl) across one or more repos
- Strictly read-only: reports findings without modifying files
- Categorizes each finding as mechanical (auto-fixable) or judgment
Workflow Audit by the numbers
- 47 all-time installs (skills.sh)
- Ranked #751 of 1,435 DevOps & CI/CD skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
workflow-audit capabilities & compatibility
- Capabilities
- workflow fix · code review · ci cd
- Works with
- github
- Use cases
- ci cd · code review
What workflow-audit says it does
Run the Bitwarden workflow linter (bwwl) against one or more repos and report findings.
This skill is strictly read-only.** Do not modify, create, or delete any files.
bwwl lint -f .github/workflows/
Inform the user that they can use the `workflow-fix` skill to apply fixes based on these findings.
npx skills add https://github.com/bitwarden/ai-plugins --skill workflow-auditAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 47 |
|---|---|
| repo stars | ★ 129 |
| Last updated | August 4, 2026 |
| Repository | bitwarden/ai-plugins ↗ |
What it does
Lint GitHub Actions workflow files across one or several repos and report categorized findings without modifying anything.
Who is it for?
Auditing .github/workflows/ files for lint rule violations across single or multiple repos.
Skip if: Applying fixes or editing workflow files (use the workflow-fix skill for that).
When should I use this skill?
You want to lint GitHub Actions workflows and get a categorized report before fixing anything.
What you get
A per-repo summary table of workflow linter findings grouped by file and rule, split into mechanical and judgment categories.
- Per-repo summary table of findings by file and rule
- Totals of mechanical and judgment findings
By the numbers
- 7 mechanical fix rules (name_capitalized, permissions_exist, pinned_job_runner, step_pinned, underscore_outputs, job_env
- 5-step workflow (verify, scope, run, categorize, report)
Files
Rules
- This skill is strictly read-only. Do not modify, create, or delete any files.
- Flag uncertainty. If a finding is ambiguous, note it in the report rather than guessing.
Step 1: Verify Prerequisites
Check if bwwl is available:
bwwl --versionIf the command is not found, stop and inform the user that bwwl must be installed before continuing. Do not attempt to install it.
Step 2: Determine Scope
Parse the user's request to determine what to lint:
- Single file or directory (e.g.,
.github/workflows/build.ymlor.github/workflows/): Operate on the current repo only. - Multiple repos (e.g., "server, clients, android"): Operate on each repo sequentially. Ask the user for the base directory where their repos are cloned. For each repo, look for its local clone at
<base-dir>/<repo>. If a clone is not found, inform the user and skip that repo. - No specific target: Lint all files in
.github/workflows/of the current directory.
Step 3: Run the Linter
For each repo in scope, run:
bwwl lint -f .github/workflows/Capture both stdout and stderr. If operating on multiple repos, announce which repo is being linted.
Step 4: Parse and Categorize Findings
From the linter output, produce a structured list of findings. Group by file and rule. Consult the bitwarden-workflow-linter-rules skill to categorize each finding:
Mechanical (can be auto-fixed):
name_capitalized,permissions_exist,pinned_job_runner,step_pinned,underscore_outputs,job_environment_prefix,check_pr_target- Simple
run_actionlintfindings (single-line shell fixes)
Judgment (requires user input):
name_exists,step_approved, complexrun_actionlintfindings
Step 5: Report
Output a summary table per repo:
| File | Finding | Rule | Category |
|---|---|---|---|
| ... | ... | ... | ... |
Include totals: mechanical findings, judgment findings, and repos with no issues.
Inform the user that they can use the workflow-fix skill to apply fixes based on these findings.
Related skills
Azure DeploySafely execute production deployments of already-prepared applications to Microsoft Azure.485k1.3kAzure ValidateRun deep pre-deployment checks on Azure configuration, infrastructure definitions, RBAC roles, and managed identities before pushing to production.485k1.3k
Github Actions DocsGet precise, docs-grounded answers about GitHub Actions workflows, syntax, security, and migration instead of relying on stale knowledge.275k72
Setup Pre CommitAutomatically run Prettier, type checking, and tests on every commit via Husky and lint-staged.170k199k
Deploy To VercelSafely turn any local project into a live Vercel preview with one instruction.99.3k29.7kVercel Cli With TokensDeploy projects to Vercel from agents and scripts using token authentication instead of interactive browser login.74.6k29.7kFAQ
Does workflow-audit modify my files?
No. The skill is strictly read-only and does not modify, create, or delete any files; it only reports findings.
How does it categorize findings?
It groups findings by file and rule, then labels each as mechanical (can be auto-fixed) or judgment (requires user input).