groq-ci-integration
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (
gh secret set) to securely store API keys as repository secrets, which is a recommended practice for secret management. - [EXTERNAL_DOWNLOADS]: The integration workflows fetch model metadata from the official Groq API (
api.groq.com) and utilize standard, well-known GitHub Actions provided by the platform (actions/checkout and actions/setup-node). - [INDIRECT_PROMPT_INJECTION]: The skill includes a model-check script that performs static analysis on the local repository's source code to extract model identifiers. It uses fixed regular expressions to parse these identifiers, minimizing the risk of processing malicious data.
- [REMOTE_CODE_EXECUTION]: The CI pipelines utilize standard package managers (npm) and test runners (vitest) to execute local code. No patterns for executing untrusted remote code or scripts were detected.
Audit Metadata