cicd-security
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes legitimate third-party security tools (zizmor, actionlint) and the GitHub CLI (gh) via shell execution. These tools are invoked with specific, read-only arguments (e.g.,
--offline) to minimize risk and are strictly aligned with the skill's purpose of auditing CI/CD configurations. - [SAFE]: Local utility scripts (validate-findings.mjs, to-sarif.mjs) are included to process and validate finding reports. These scripts use standard Node.js APIs for file and path operations and do not perform any hidden or suspicious network or system operations.
- [SAFE]: The skill includes extensive 'Authorization' and 'Boundaries' documentation. It explicitly forbids the agent from proving vulnerabilities with live exploits, printing secret values, or executing workflows without user consent.
- [SAFE]: No malicious patterns such as prompt injection, data exfiltration, obfuscation, or unauthorized privilege escalation were detected. The skill's attack surface (processing untrusted YAML files) is handled by instructing the agent to treat external content as data and relying on specialized linters for parsing.
Audit Metadata