claude-code-ci
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the Claude Code CLI using
npm install -g @anthropic-ai/claude-code. This targets the official package from Anthropic, which is a well-known and recognized service provider. - [PROMPT_INJECTION]: The skill illustrates how to ingest untrusted data (git diffs from pull requests) for automated review. This represents an indirect prompt injection surface where a contributor could embed instructions in a diff to influence the agent. The skill addresses this risk by demonstrating how to use
--allowedToolsto restrict the agent's capabilities to read-only operations during review tasks. - [CREDENTIALS_UNSAFE]: The integration examples correctly use GitHub Secrets (
${{ secrets.ANTHROPIC_API_KEY }}) to handle authentication tokens, adhering to secure CI/CD configuration standards.
Audit Metadata