GitHub Actions
Pass
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill explicitly instructs the agent to never request sensitive information such as personal access tokens or cloud keys from the user, following credential safety best practices.- [SAFE]: External network communication is restricted to well-known GitHub services (github.com and api.github.com) for official repository and workflow management.- [SAFE]: The skill promotes the principle of least privilege by recommending explicit job-level permissions and the use of OIDC for short-lived cloud credentials.- [SAFE]: Local data persistence is isolated to a specific directory (~/github-actions/) for maintaining workflow context and incident logs, avoiding interference with sensitive system files.- [SAFE]: Guidance includes supply chain security measures such as pinning action versions by SHA and reviewing third-party actions before use.- [SAFE]: No malicious patterns, obfuscation, or unauthorized persistence mechanisms were detected across the skill files.
Audit Metadata