merge-time-ci-economics
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a shell script (
scripts/actions-minutes.sh) that performs read-only operations via the GitHub API. It reconstructs billed minutes by fetching job durations and rounding them up, matching GitHub's billing logic. The script outputs data to a local temporary directory or a user-specified path and does not perform any network operations to non-whitelisted or suspicious domains. - [SAFE]: The skill uses the GitHub CLI (
gh) for authentication and API interaction, which follows security best practices by leveraging the user's existing environment credentials rather than requesting hardcoded secrets or tokens. - [SAFE]: Instructions for modifying CI workflows and branch protection rules are provided as markdown templates and outlines. While these instructions give the agent the capability to modify repository configuration, this behavior is central to the skill's stated purpose of 'redesigning CI' and does not involve any deceptive or harmful patterns.
- [SAFE]: No obfuscation, prompt injection, or persistence mechanisms were found. All provided code is transparent and documented.
Audit Metadata