github-action-authoring
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several external URLs for downloading installer scripts and binaries from the vendor's official distribution domains (
downloads.ortussolutions.comandwww.ortussolutions.com). These references are used to facilitate the installation of BoxLang and CommandBox within CI/CD pipelines. - [COMMAND_EXECUTION]: The instructions detail the use of shell commands in both Bash and PowerShell environments (e.g.,
Invoke-WebRequest,Add-Content,New-Item,curl,unzip) to manage files and environment variables within GitHub Actions runners. - [REMOTE_CODE_EXECUTION]: The skill provides patterns for downloading and executing installation scripts (e.g.,
install-boxlang.shandinstall-boxlang.ps1). It explicitly recommends against usingInvoke-Expressionon web content, instead suggesting a more secure approach of saving to a temporary file before execution.
Audit Metadata