github-actions-templates
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill functions as a template generator for CI/CD workflows, which involves processing project context to generate configuration files. * Ingestion points: The skill interprets user-provided repository details and workflow requirements to select and adapt templates. * Boundary markers: As a static template repository, it does not implement dynamic boundary markers but provides the structure for secure workflow execution. * Capability inventory: Templates include standard CI/CD commands such as package installation (npm, pip), containerization (docker), and infrastructure deployment (kubectl, aws). * Sanitization: The skill follows best practices by instructing the agent to use GitHub Secrets for environment variables and credentials.
- [EXTERNAL_DOWNLOADS]: The templates reference several external GitHub Actions from trusted organizations and well-known services. * Trusted Organizations: Uses official actions from GitHub (actions/checkout, actions/setup-node, actions/setup-python, github/codeql-action) and AWS (aws-actions/configure-aws-credentials). * Well-Known Services: Incorporates established tools from Docker (docker/login-action, docker/build-push-action), security vendors (aquasecurity/trivy-action, snyk/actions), and utility providers (codecov/codecov-action, slackapi/slack-github-action).
Audit Metadata