github-actions

Pass

Audited by Gen Agent Trust Hub on Apr 8, 2026

Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [SAFE]: The skill serves as a legitimate template library and educational guide for GitHub Actions, following industry security standards.
  • [CREDENTIALS_UNSAFE]: The Python CI templates contain a hardcoded password ('test') for a PostgreSQL service container. While standard for ephemeral test environments, it is noted as a hardcoded value.
  • [COMMAND_EXECUTION]: A composite action example in SKILL.md uses an input variable directly in a shell command, which is a standard pattern for CI flexibility but requires users to ensure inputs are trusted.
  • [EXTERNAL_DOWNLOADS]: The workflow templates utilize official GitHub Actions and standard package managers to fetch dependencies from trusted public registries.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 8, 2026, 02:40 PM
Security Audit — agent-trust-hub — github-actions