deepgram-ci-integration
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides configuration templates for GitHub Actions and GitLab CI that utilize repository secrets (
DEEPGRAM_API_KEY,DEEPGRAM_ADMIN_KEY) for authentication, which is the standard security practice for CI/CD environments. - [SAFE]: The provided GitHub Actions workflows include security conditions (e.g.,
if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) to ensure that sensitive secrets are not exposed to untrusted pull requests originating from forks. - [SAFE]: Network operations and API calls target official, well-known Deepgram services (
api.deepgram.com,static.deepgram.com) for testing and secret rotation. These are legitimate vendor resources consistent with the skill's primary purpose. - [SAFE]: The key rotation workflow uses the official GitHub CLI (
gh secret set) and follows a documented quarterly schedule, which is a recommended security procedure for maintaining long-term API access. - [SAFE]: All dependencies mentioned (e.g.,
@deepgram/sdk,vitest,tsx) are standard, well-known development tools in the Node.js ecosystem.
Audit Metadata