github-actions-trigger
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates automation by communicating with the official GitHub API at
api.github.com, which is a well-known and trusted service for development workflows.- [SAFE]: Authentication is handled using user-provided tokens stored in the agent's context memory, which is a secure and standard practice for avoiding hardcoded credentials.- [EXTERNAL_DOWNLOADS]: The skill fetches workflow runs and log data from GitHub. This is a functional requirement for its monitoring capabilities and targets a trusted service.- [PROMPT_INJECTION]: An attack surface for indirect prompt injection exists because the skill reads external data from GitHub logs (get_logsinSKILL.md) and reports it back to the agent without using specific boundary markers or sanitization. This risk is inherent to tools that monitor external process outputs.
Audit Metadata