github-actions-finops
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
gh apiandgh repocommands to interact with the GitHub API for data gathering. These are well-known and expected tools for GitHub Actions analysis. - [COMMAND_EXECUTION]: The
SKILL.mdfile uses dynamic context injection (!git remote -v,!find,!gh workflow list) to provide environment context to the agent. These commands are localized to the current repository and do not involve data exfiltration or sensitive path access. - [SAFE]: The execution script
scripts/github-actions-finops.shimplements deterministic data gathering. It usesjqfor data processing and includes a fixture mechanism for offline testing, which is a security best practice for validating behavior without live network access. - [SAFE]: Administrative billing endpoints (
/orgs/{org}/settings/billing/actions) are documented and used, but the skill includes checks forBILLING_AVAILABLE=falseif the user lacks the necessary administrative permissions, preventing unauthorized access attempts or error loops.
Audit Metadata