github-actions-expert
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as an educational and utility resource for CI/CD development, correctly promoting security practices like SHA-pinning for actions and minimal permission scopes.
- [EXTERNAL_DOWNLOADS]: The workflow templates reference official GitHub-maintained actions (actions/checkout, actions/cache, actions/setup-node) and well-known service providers (aws-actions/configure-aws-credentials) which is standard and expected behavior for GitHub Actions.
- [COMMAND_EXECUTION]: Includes standard shell-based diagnostic commands (grep, awk, yamllint, gh CLI) intended for local workflow analysis and performance monitoring. These commands are descriptive and contextually appropriate for the skill's purpose.
- [DATA_EXFILTRATION]: No unauthorized data exfiltration patterns were found. Secret usage in examples follows the standard GitHub Actions syntax for secure credential handling.
Audit Metadata