github-actions-pipeline-creator
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard boilerplate for GitHub Actions workflows, including stages for linting, testing, and deployment.
- [SAFE]: Instructions correctly guide users to use GitHub Secrets syntax (e.g.,
${{ secrets.VERCEL_TOKEN }}) for managing sensitive information, adhering to security best practices. - [EXTERNAL_DOWNLOADS]: The skill references and downloads standard GitHub Actions from well-known and trusted organizations, including GitHub (
actions/checkout,actions/setup-node,actions/upload-artifact), Docker (docker/build-push-action), Vercel (amondnet/vercel-action), and Codecov (codecov/codecov-action). - [COMMAND_EXECUTION]: Shell commands defined in the workflow templates (e.g.,
npm ci,npm test,npm run build) are standard Node.js development commands intended for execution within an isolated CI runner environment. - [INDIRECT_PROMPT_INJECTION]: The skill includes a surface for external data ingestion via GitHub Actions
workflow_dispatchinputs. However, security is maintained as theenvironmentinput is defined as achoicetype (restricted to 'staging' or 'production'), preventing arbitrary payload injection into the workflow context.
Audit Metadata