bitwarden-workflow-linter-rules
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill defines rules for auditing GitHub Actions workflows, specifically focusing on supply chain security and hardening. For example, the 'step_pinned' rule enforces the use of 40-character commit SHAs for external actions, which is a key security measure to prevent tag-based attacks.- [COMMAND_EXECUTION]: The skill instructs the agent to use standard, legitimate tools such as 'gh api' (GitHub CLI) for resolving commit hashes and 'actionlint' for validating workflow syntax. These commands are localized to developer-focused tasks and do not involve suspicious pipe-to-shell or arbitrary execution patterns.- [SAFE]: The 'check_pr_target' rule provides specific guidance to mitigate risks associated with the 'pull_request_target' trigger by ensuring jobs are restricted to the default branch. This aligns with industry-standard security hardening for GitHub Actions.- [SAFE]: No obfuscation, hidden URLs, data exfiltration, or persistence mechanisms were found. The skill serves as a reference guide for improving the security posture of repository workflows.
Audit Metadata