dash0-sync-docs

Pass

Audited by Gen Agent Trust Hub on Aug 4, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides commands for local verification in Workflow C, such as pnpm install --frozen-lockfile and node packages/transformation-engine/src/apply-transformations.ts. These are standard development operations intended to be run within a clone of the vendor's own repository.
  • [EXTERNAL_DOWNLOADS]: The skill references dependencies and scripts from the dash0hq/sync-docs-action repository. Since the resources belong to the authoring vendor, they are considered safe for the intended purpose of the skill.
  • [CREDENTIALS_UNSAFE]: The instructions explicitly guide users to supply sensitive information, such as the target-github-token and repository coordinates, via GitHub Secrets (e.g., ${{ secrets.REPOSITORY_FULL_ACCESS_GITHUB_TOKEN }}). This aligns with security best practices for CI/CD workflows.
  • [PROMPT_INJECTION]: The content consists of legitimate technical documentation and configuration templates. There are no patterns indicating attempts to override agent constraints or bypass safety guidelines.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 4, 2026, 12:53 PM
Security Audit — agent-trust-hub — dash0-sync-docs