github-actions-runtime-upgrade-conventions
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill contains no executable code or scripts. It consists entirely of instructional markdown guiding an AI agent on how to manage GitHub Actions versions safely.
- [SAFE]: The skill promotes security best practices by instructing the agent to use immutable commit SHAs for action versions instead of mutable tags (e.g., @v4), which helps prevent supply chain attacks.
- [INDIRECT_PROMPT_INJECTION]: The skill involves reading and editing GitHub Action workflow files (
.github/workflows/*.yml). - Ingestion points: Reads existing
.ymlor.yamlworkflow files. - Boundary markers: None explicitly defined in the instructions.
- Capability inventory: File modification (editing workflow files).
- Sanitization: None described, however, the scope is limited to version string upgrades and SHA pinning, which minimizes the risk of executing untrusted instructions embedded in the workflow files.
Audit Metadata