secure-github-actions
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a defensive resource providing hardening rules and auditing scripts for GitHub Actions. A detailed review confirmed no malicious behavior or security risks.
- [PROMPT_INJECTION]: No instructions were found that attempt to bypass safety guidelines or override agent behavior. The skill includes appropriate scoping for its defensive tasks.
- [DATA_EXFILTRATION]: No evidence of unauthorized data access or exfiltration was detected. Secret placeholders in examples are used solely for educational purposes to demonstrate secure coding.
- [REMOTE_CODE_EXECUTION]: No remote script execution from untrusted sources was found. The auditing tools utilize standard local commands and the trusted 'pyyaml' Python package.
- [DYNAMIC_EXECUTION]: The skill utilizes 'uv' to run a static local Python script for YAML analysis, which is an acceptable and safe method for the intended security auditing purpose.
Audit Metadata