github-actions
Fail
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script
scripts/lint-workflows.shperforms remote code execution by piping a downloaded script directly into a bash shell using process substitution:bash <(curl -sL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash). This pattern is high-risk as it executes remote code without integrity verification or pin-to-hash security. - [COMMAND_EXECUTION]: The skill provides scripts and instructions that execute shell commands, including project-specific linting tools and Cloudflare deployment commands via
wranglerand the GitHub CLI (gh). - [EXTERNAL_DOWNLOADS]: The skill downloads the
actionlintbinary and its installation script from an external GitHub repository (rhysd/actionlint). While this is a known utility for GitHub Actions, the installation method bypasses package managers and local security controls.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash - DO NOT USE without thorough review
Audit Metadata