dash0-sync-docs
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides commands for local verification in Workflow C, such as
pnpm install --frozen-lockfileandnode packages/transformation-engine/src/apply-transformations.ts. These are standard development operations intended to be run within a clone of the vendor's own repository. - [EXTERNAL_DOWNLOADS]: The skill references dependencies and scripts from the
dash0hq/sync-docs-actionrepository. Since the resources belong to the authoring vendor, they are considered safe for the intended purpose of the skill. - [CREDENTIALS_UNSAFE]: The instructions explicitly guide users to supply sensitive information, such as the
target-github-tokenand repository coordinates, via GitHub Secrets (e.g.,${{ secrets.REPOSITORY_FULL_ACCESS_GITHUB_TOKEN }}). This aligns with security best practices for CI/CD workflows. - [PROMPT_INJECTION]: The content consists of legitimate technical documentation and configuration templates. There are no patterns indicating attempts to override agent constraints or bypass safety guidelines.
Audit Metadata