depot-github-runners
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely instructional, providing documentation for integrating Depot-managed GitHub Actions runners into workflows.
- [COMMAND_EXECUTION]: Includes examples of the official
depotCLI tool (e.g.,depot org list,depot org switch) for organization management. These are standard operations for the vendor's service. - [EXTERNAL_DOWNLOADS]: References official documentation and status pages at
depot.devandstatus.depot.dev, which are legitimate vendor domains. - [CREDENTIALS_UNSAFE]: Correctly advises using secrets (e.g.,
DEPOT_TOKEN) for authentication in CI/CD environments rather than hardcoding credentials. - [SAFE]: Mentions the use of standard GitHub Actions such as
actions/checkoutandmxschmitt/action-tmatefor routine development tasks like code checkout and debugging.
Audit Metadata