github-actions-workflow-design
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses structured templates and checklists to ensure that GitHub Actions workflows are designed with explicit trigger scopes and security boundaries.
- [SAFE]: The included references, such as the actions-permissions-matrix.md, enforce industry-standard security principles by mandating a read-only baseline and per-job permission elevation.
- [SAFE]: The workflow snippets utilize official and well-known actions, promoting the use of trusted components in CI/CD pipelines.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided repository requirements and build policies (SKILL.md) to generate workflow designs. While this constitutes a vulnerability surface, the risk is mitigated by explicit instructions to split jobs by responsibility and assign least-privilege permissions (SKILL.md, references/actions-permissions-matrix.md). The skill generates static design documentation and configuration templates without direct execution capabilities. No specific sanitization is implemented for these design-time inputs.
Audit Metadata