github-action
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructs users to manage credentials via GitHub Actions Secrets (
CROWDIN_PROJECT_ID,CROWDIN_PERSONAL_TOKEN) and environment variables, which is the industry standard for secure CI/CD workflows. - [EXTERNAL_DOWNLOADS]: The skill references the official
crowdin/github-actionrepository and its associated documentation on GitHub. These are trusted, well-known sources belonging to the software's author. - [COMMAND_EXECUTION]: While the skill describes using a
commandinput for the Crowdin CLI, these are bounded to legitimate translation tasks (e.g.,status,pre-translate) and are executed within a Docker container specifically designed for these tools. - [INDIRECT_PROMPT_INJECTION]: The skill correctly warns that
git add .in a workflow can commit unintended files if the job is not properly isolated. It provides remediation guidance (using separate jobs or specific checkout strategies) to prevent untrusted build artifacts from entering the repository's translation branch.
Audit Metadata