You can access GET variables with [get_VARIABLE], POST variables with [post_VARIABLE], PHP Session variables with [session_VARIABLE]. In addition to whatever fields you've available within CB > Field Management using normal substitutions. See the below tutorial for substitution usage information.
www.joomlapolis.com/documentation/279-community-builder/tutorials/18353-using-substitutions-throughout-cb
You can also access trigger variables using [var1-15]. For example if the first variable of a trigger is a user object you can grab that user objects username with [var1_username]. All of this is explained as part of the User parameter description. See the below tutorial for trigger variable information.
www.joomlapolis.com/documentation/279-community-builder/tutorials/18358-using-cb-triggers
There is no substitution for the current URL. As for usergroups the best way to condition against those is to not condition against them and instead adjust the Access for the auto action it self. If necessary to condition against them then I suggest using the IF substitutions shown at the bottom of the substitution tutorial.
to be honest, the documentation of auto actions seems a little thin....
It's a tool. There's nothing beyond the parameter descriptions to document. What you're asking for is a usecase tutorial, which yes we have very few of. We can't know what GET/POST/SESSION values your install has available so it's impossible to document some of the things you're asking about. I highly suggest reading parameter descriptions carefully.
krileon
