branch-cleanup
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard
gitandgh(GitHub CLI) commands to inspect branch metadata, check pull request statuses, and verify repository settings. These are necessary for the skill's primary function and are implemented usingsubprocess.runwith proper argument handling and shell quoting viashlex.quotein the Python script. - [REMOTE_CODE_EXECUTION]: The skill uses
github.tokenwithin a GitHub Action workflow file (assets/stale-branch-report.yml). This is a standard practice for automated reports within the GitHub ecosystem. The workflow is restricted to reading content and pull requests, and it only writes to the job summary, ensuring no destructive remote operations can occur through this mechanism. - [SAFE]: The skill follows security best practices by implementing an 'explicit authorization' guardrail. It prints the exact commands for the user to review and manually execute rather than performing deletions itself. It also uses SHA-pinned versions for external actions (e.g.,
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) to mitigate supply chain risks.
Audit Metadata