github-actions-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a template repository for GitHub Actions workflows, providing documented examples for common CI/CD tasks.
- [EXTERNAL_DOWNLOADS]: The workflows reference official and well-known GitHub Actions from trusted organizations including GitHub (actions/), AWS (aws-actions/), Docker (docker/), HashiCorp (hashicorp/), and security vendors like Aqua Security (trivy-action) and Gitleaks. These are standard dependencies for modern CI/CD pipelines.
- [COMMAND_EXECUTION]: The skill uses standard shell commands (
pip install,pytest,terraform) to perform testing and deployment tasks within the isolated environment of a CI runner. - [CREDENTIALS_UNSAFE]: The skill includes hardcoded credentials (
test/test) for a PostgreSQL service container. These are used only for local integration testing within the CI environment and do not represent a risk to production secrets or user data. It correctly demonstrates the use of GitHub Secrets (secrets.AWS_ROLE_ARN) for sensitive cloud credentials. - [INDIRECT_PROMPT_INJECTION]: The Terraform workflow ingests the output of the
terraform plancommand into a GitHub comment script. While this represents a data ingestion surface, it is a standard practice for developer feedback, and the script wraps the content in markdown code blocks to prevent unintended interpretation by the UI.
Audit Metadata