instantly-ci-integration
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements standard secret management best practices by instructing users to use GitHub Secrets (e.g.,
secrets.INSTANTLY_API_KEY) rather than hardcoding credentials in the workflow files. - [SAFE]: A pre-commit Bash script is provided that actively scans the source code for potential API keys (using a regex pattern for Bearer tokens) to prevent them from being committed to version control.
- [SAFE]: External GitHub Actions referenced in the workflows (
actions/checkout,actions/setup-node,google-github-actions/deploy-cloudrun) are maintained by trusted organizations (GitHub and Google). - [SAFE]: Network operations are directed towards official service domains (
api.instantly.ai,developer.instantly.ai) or user-defined cloud infrastructure (Google Cloud Run), posing no exfiltration risk to untrusted third parties. - [SAFE]: The skill uses a mock server for testing, which is a recommended practice to avoid exhausting production API limits or triggering unintended side effects during automated CI runs.
Audit Metadata