preview-environments-builder

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references standard GitHub Actions including actions/checkout, actions/setup-node, and actions/github-script. It also utilizes a widely recognized community action, amondnet/vercel-action, for facilitating Vercel deployments within automated workflows.
  • [CREDENTIALS_UNSAFE]: The documentation demonstrates secure secret management by instructing the use of GitHub Secrets (e.g., ${{ secrets.VERCEL_TOKEN }}, ${{ secrets.PREVIEW_DB_URL }}) to handle sensitive credentials rather than hardcoding them into the configuration files.
  • [INDIRECT_PROMPT_INJECTION]: The templates utilize pull request metadata (specifically the PR number) to dynamically generate environment and database names. This is a standard DevOps practice and is handled securely within the GitHub Actions expression environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 06:13 PM
Security Audit — agent-trust-hub — preview-environments-builder