github-workflow-automation
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the GitHub CLI (
gh) and shell commands to perform repository operations, such as creating pull requests, managing issues, and viewing workflow run statuses. This is the primary function of the skill and aligns with its stated purpose of GitHub workflow automation. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto download and run specialized CLI tools, specificallyruv-swarmandclaude-flow, which are central to its swarm coordination functionality. These downloads occur during the initialization and execution phases of the workflows. - [REMOTE_CODE_EXECUTION]: Remote code execution is facilitated through the
npxcommand, which fetches and executes packages from the npm registry at runtime. This mechanism is used to invoke theruv-swarmandclaude-flowautomation logic. - [SAFE]: The skill follows security best practices for secret management by instructing the use of GitHub Secrets (
secrets.SWARM_CONFIG,secrets.API_KEY) to handle sensitive configuration and credentials within workflows, preventing hardcoded secrets exposure.
Audit Metadata