diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 19030da..f73b626 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,14 +6,20 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     name: Lint & Verify
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -21,14 +27,17 @@ jobs:
           python-version: "3.11"
 
       - name: Run skin linter
-        run: python scripts/lint-skin.py --all --baseline
+        run: python3 scripts/lint-skin.py --all --baseline
 
       - name: Verify sequence OAuth specs
-        run: python scripts/verify-sequence-oauth.py
+        run: python3 scripts/verify-sequence-oauth.py
 
       - name: Verify draw.io import script
-        run: python scripts/verify-drawio-import.py
-
-      - name: Verify icon build script
-        run: python scripts/build-icons.py
+        run: python3 scripts/verify-drawio-import.py
 
+      - name: Verify generated icon assets
+        run: |
+          python3 scripts/build-icons.py
+          git diff --ignore-space-at-eol --exit-code -- \
+            skills/diagram-design/assets/icons.html \
+            skills/diagram-design/references/primitive-icons.md