building-ci-pipelines
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill and its associated scripts do not contain any malicious patterns, obfuscation, or unauthorized data access behaviors.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The skill strongly encourages the use of OIDC federation and GitHub Secrets for secure authentication.
- The included
validate_workflow.pyscript specifically checks for hardcoded secret patterns in YAML configurations. - [REMOTE_CODE_EXECUTION]: The skill references official and reputable GitHub Actions (e.g.,
actions/checkout,actions/setup-node,docker/build-push-action) and well-known security tools (Snyk, Gitleaks, Anchore). - [INDIRECT_PROMPT_INJECTION]: The instructions explicitly highlight the risks of using high-privilege triggers like
pull_request_targetand provide guidance on avoiding insecure configurations. - [SUPPLY_CHAIN_SECURITY]: The skill actively teaches defensive strategies, including SLSA provenance generation, artifact signing with Sigstore/Cosign, and SBOM (Software Bill of Materials) creation.
Audit Metadata