ov-github-actions-ci
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill mandates the use of full commit SHAs for third-party actions to prevent supply-chain attacks via tag-floating.
- [SAFE]: It enforces the Principle of Least Privilege (PoLP) by instructing callers to start with 'read-all' permissions and only grant necessary scopes at the job level.
- [SAFE]: It provides explicit guidance on preventing shell injection by treating all 'github.event' metadata as untrusted and routing it through environment variables rather than direct string interpolation.
- [SAFE]: The skill identifies internal security documentation as the authoritative source for CI changes, ensuring consistency with institutional security policies.
- [SAFE]: Requirements for custom Python actions include pinning the full dependency tree via 'pip freeze', ensuring reproducible and auditable build environments.
Audit Metadata