github-actions-ci
Warn
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs users to install the
acttool usingcurl -s https://raw.githubusercontent.com/nektos/act/master/install.sh | sudo bash. This method downloads a script from a remote repository and executes it directly in the shell, posing a risk if the source or transport is compromised. - [COMMAND_EXECUTION]: The skill suggests configuring Claude Code hooks in
.claude/settings.jsonand pre-commit hooks to automatically execute shell commands likeactionlint,yamllint, andghwhen files are edited or committed. - [EXTERNAL_DOWNLOADS]: The skill encourages downloading and using several third-party tools and actions, including
nektos/act,rhysd/actionlint, andadrienverge/yamllint. It also promotes the use of the author's own repositoryarustydev/ghafor centralized actions.
Audit Metadata