github-actions
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a set of documentation and templates that promote security best practices for GitHub Actions workflows.
- [EXTERNAL_DOWNLOADS]: References official and verified GitHub Actions and CLI tools from trusted sources like GitHub (
actions/*), Fly.io (superfly/*), and well-known community providers. These references are documented neutrally for their intended purpose in CI/CD pipelines. - [INDIRECT_PROMPT_INJECTION]: The documentation explicitly identifies the risks of processing untrusted data (such as pull request titles or issue comments) and provides secure code examples using environment variables to sanitize these inputs.
- [COMMAND_EXECUTION]: Includes shell script templates for standard build and deployment tasks. The skill provides clear guidance on managing execution safely, including non-root Docker execution and process timeouts.
- [CREDENTIALS_UNSAFE]: Promotes the use of GitHub Secrets and OpenID Connect (OIDC) for secure secret management, and provides warnings against hardcoding credentials in workflows.
Audit Metadata