running-github-actions-efficiently
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download binary releases for
SwiftLintandSwiftFormatfrom external GitHub repositories (realm/SwiftLintandnicklockwood/SwiftFormat). - [PRIVILEGE_ESCALATION]: The provided shell scripts use
sudo installto move downloaded binaries into/usr/local/bin/, which requires root privileges on the runner environment. - [COMMAND_EXECUTION]: The instructions include multiple shell command blocks for environment setup, tool installation, and running linters (
curl,unzip,install,swiftlint,swiftformat). - [INDIRECT_PROMPT_INJECTION]: The skill includes self-referential commentary targeting the repository it is placed in, claiming to have identified missing configurations in
.github/workflows/ci.yml. - Ingestion points:
SKILL.md(specifically the 'Note for this repository' section). - Boundary markers: Absent; the text is presented as authoritative guidance.
- Capability inventory: The skill provides instructions for modifying CI workflows and executing shell commands.
- Sanitization: None; the text is processed as standard documentation.
Audit Metadata