create-gh-pages-site
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches templates from the jongio/gh-pages-templates repository. This process is secured by pinning to an immutable 40-character commit SHA (101139f9c8bb872b13ad84e18d90435e7a15f107) and verifying the checkout integrity.
- [COMMAND_EXECUTION]: The generator invokes git commands to manage the template registry and detect the current repository state, following standard development tooling practices.
- [INDIRECT_PROMPT_INJECTION]: The skill reads project READMEs and metadata to tailor site content. It mitigates injection risks by sanitizing all substituted variables (such as site name and description) against a strict character allow-list, preventing the introduction of malicious markup or control characters into the generated source code.
- [DYNAMIC_EXECUTION]: The generator includes a security validation suite for GitHub Actions workflows. It automatically scans templates for unsafe triggers (like pull_request_target), unpinned action references, missing job timeouts, and potential command injection via GitHub context interpolation, rejecting any template that violates these policies.
Audit Metadata