rust-node-ci
Warn
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The composite actions provided in the templates use direct shell interpolation of inputs within
runblocks, which is a known security risk in GitHub Actions. - In
templates/actions/wait-npm-propagation/action.yml, thepackagesinput is interpolated directly into a bash script:PACKAGES='${{ inputs.packages }}'. If a maliciously crafted input containing single quotes is provided, it can break out of the variable assignment and execute arbitrary shell commands. - In
templates/actions/compute-version/action.yml, multiple inputs (base-version,is-release, andrun-id) are interpolated into double-quoted shell variables. If these inputs contain double quotes and shell expansion sequences (e.g.,$(...)), they could lead to command execution in the runner context. - [EXTERNAL_DOWNLOADS]: The skill templates and workflows reference several external GitHub Actions from standard sources:
- Official GitHub actions including
actions/checkout@v4,actions/setup-node@v4,actions/upload-artifact@v4, andactions/download-artifact@v4. - Third-party actions such as
pnpm/action-setup@v4,dtolnay/rust-toolchain@stable, andSwatinem/rust-cache@v2. - These references are used according to standard CI/CD practices for Rust and Node.js hybrid projects.
Audit Metadata