github-workflow-automation
Warn
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation and examples frequently use
npxto download and execute packages from the npm registry, specificallyruv-swarmandclaude-flow@alpha. These tools originate from a vendor not recognized as trusted and are granted access to repository data. - [REMOTE_CODE_EXECUTION]: The skill uses
npxto execute code directly from a remote package registry. Additionally, it includes a GitHub Action template that usesruvnet/swarm-action@v1, which is an external dependency that executes code within the CI/CD environment. - [COMMAND_EXECUTION]: The skill involves executing complex shell commands that pipe output from the GitHub CLI (
gh)—containing potentially sensitive repository data like pull request contents and logs—into third-party CLI tools. - [COMMAND_EXECUTION]: Several features, such as the "Self-Healing Pipeline" and "Smart Deployment," perform automated high-privilege operations including code fixes and deployment execution based on logic provided by unverified external swarm agents.
Audit Metadata