github-actions-ci

Warn

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs users to install the act tool using curl -s https://raw.githubusercontent.com/nektos/act/master/install.sh | sudo bash. This method downloads a script from a remote repository and executes it directly in the shell, posing a risk if the source or transport is compromised.
  • [COMMAND_EXECUTION]: The skill suggests configuring Claude Code hooks in .claude/settings.json and pre-commit hooks to automatically execute shell commands like actionlint, yamllint, and gh when files are edited or committed.
  • [EXTERNAL_DOWNLOADS]: The skill encourages downloading and using several third-party tools and actions, including nektos/act, rhysd/actionlint, and adrienverge/yamllint. It also promotes the use of the author's own repository arustydev/gha for centralized actions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 16, 2026, 04:16 PM
Security Audit — agent-trust-hub — github-actions-ci