ci-security-gates
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches GitHub Actions from the trusted
actionsandgithuborganizations, and the well-knowngitleaksrepository. - [COMMAND_EXECUTION]: Provides templates for executing standard build and security commands including
npm audit,pip audit, andsemgrep. - [INDIRECT_PROMPT_INJECTION]: (1) Ingestion points: The CI pipeline ingests untrusted code from repository commits (SKILL.md). (2) Boundary markers: The skill explicitly configures security scanners (CodeQL, Gitleaks, Semgrep) to act as boundaries and validate the ingested content. (3) Capability inventory: The pipeline executes shell commands including
npm ci,npm run build,npm run deploy, and security audit tools. (4) Sanitization: External content is sanitized via SAST scanning and secret detection before the deployment phase.
Audit Metadata