gha-security-review
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is entirely instructional and does not contain executable code, scripts, or remote dependencies.
- [COMMAND_EXECUTION]: The skill provides PowerShell snippets using standard
gitandSelect-Stringcommands. These are used locally to search for specific strings (e.g.,pull_request_target,actions/checkout) within the user's repository files for auditing purposes. They do not download or execute remote content. - [PROMPT_INJECTION]: No prompt injection or bypass attempts were found. The instructional language is professional and focused on the stated purpose of security auditing.
- [DATA_EXFILTRATION]: No network operations or patterns associated with data exfiltration are present. The file search commands are scoped to local repository metadata.
- [EXTERNAL_DOWNLOADS]: The skill does not reference or download external packages or scripts.
Audit Metadata