repos
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a secure-by-default posture for secrets management, prioritizing short-lived OIDC credentials via Pulumi ESC over long-lived GitHub repository secrets.
- [SAFE]: All operations that mutate repository settings, infrastructure, or history (e.g.,
git filter-repo, repository creation, or secret migration) are subject to an explicit approval requirement defined in the main routing logic. - [SAFE]: The 'ci harden' reference includes specific security recommendations such as pinning GitHub Actions to commit SHAs, implementing deny-by-default permissions, and restricting
pull_request_targetusage to mitigate supply chain risks. - [SAFE]: Instructions include clear prohibitions against printing secret values to logs, chat, or commits, and emphasize proper environment-scoped access controls.
Audit Metadata