managing-workflow-secrets
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill defines a canonical pattern for secret retrieval that prioritizes security hygiene. It includes a specific checklist to ensure secrets are not exposed through logs, files, or command-line arguments.
- [SAFE]: The skill uses vendor-controlled GitHub Actions (bitwarden/gh-actions) for core functionality. These references are consistent with the skill's purpose and the author's identity.
- [SAFE]: The skill implements least-privilege access control by instructing the agent to configure minimal permissions for GitHub Actions jobs, specifically using
id-token: writeonly where required for OIDC authentication.
Audit Metadata