project-sync-issues
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
Fandhe-AI/actions/project-sync@main, which is a repository owned by the vendor (Fandhe-AI). It also referencesactions/create-github-app-token@v2, which is provided by a well-known service (GitHub/Microsoft). - [CREDENTIALS_UNSAFE]: The instructions guide users through setting up Personal Access Tokens (PAT) and GitHub App tokens. It correctly identifies that standard
GITHUB_TOKENpermissions are insufficient for Projects v2 and directs users to store these credentials securely as GitHub Secrets (secrets.PROJECT_TOKEN,secrets.APP_PRIVATE_KEY) rather than hardcoding them. - [COMMAND_EXECUTION]: The skill employs various GitHub CLI (
gh) commands to retrieve repository info, list project items, and update status fields. These operations are transparent, require authenticated local environment access, and align with the skill's primary objective.
Audit Metadata