build-ci-cd-pipeline
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several GitHub Actions from trusted organizations for pipeline functionality, including:
actions/checkout,actions/setup-node,actions/cache,actions/upload-artifact, andactions/download-artifactfrom GitHub's official repository.aws-actions/configure-aws-credentialsfor secure cloud authentication.aquasecurity/trivy-action,github/codeql-action, andtrufflesecurity/trufflehogfor security auditing and secret detection.slackapi/slack-github-actionandsoftprops/action-gh-releasefor notifications and release management.- [COMMAND_EXECUTION]: The provided YAML workflow examples include standard shell commands for building applications (
npm run build), running tests (npm ci), and synchronizing files with cloud storage (aws s3 sync). These commands are part of the core functionality for a CI/CD pipeline. - [DATA_EXFILTRATION]: The skill includes a step to record deployment events in Datadog via a POST request to
api.datadoghq.com. Because this targets a well-known observability service for its intended purpose of deployment tracking, it is not considered a security risk. - [CREDENTIALS_UNSAFE]: The skill demonstrates the correct method for handling sensitive information by using GitHub Secrets (e.g.,
${{ secrets.SLACK_WEBHOOK_URL }}) and OIDC roles (role-to-assume) instead of hardcoding credentials.
Audit Metadata