preview-environments-builder
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of standard CI/CD configuration templates intended for automation. The instructions and YAML snippets align with common DevOps practices for creating preview deployments.
- [CREDENTIALS_UNSAFE]: The skill demonstrates safe credential handling by using GitHub Secrets placeholders (e.g.,
${{ secrets.VERCEL_TOKEN }},${{ secrets.PREVIEW_DB_URL }}) instead of hardcoding sensitive keys or passwords. - [EXTERNAL_DOWNLOADS]: Referenced external resources include official GitHub Actions (
actions/checkout,actions/setup-node,actions/github-script) and a widely recognized community action (amondnet/vercel-action). These are expected dependencies for the stated purpose of the skill. - [INDIRECT_PROMPT_INJECTION]: The automation includes a step to post a PR comment containing deployment metadata. While this processes external data (PR number, deployment URL), the ingestion and usage are standard for CI/CD notifications and do not introduce significant attack surface.
- [COMMAND_EXECUTION]: Uses standard command-line tools such as
npm,docker,kubectl, andpsqlwithin the context of a build runner to perform legitimate deployment and database seeding tasks.
Audit Metadata