optimizing-github-actions
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No malicious injection patterns detected. The instructions establish a professional auditor persona without attempting to override safety constraints or extract system prompts.
- [COMMAND_EXECUTION]: Shell usage is limited to repository auditing via 'git' and 'gh' commands. No dangerous command patterns, privilege escalation, or persistence mechanisms were found.
- [EXTERNAL_DOWNLOADS]: The auditing script utilizes the official GitHub API to resolve action tags to their respective SHAs. This interaction targets a well-known service and is integral to the skill's security auditing function.
- [DATA_EXFILTRATION]: No sensitive data access or exfiltration patterns were detected. The skill operates on workflow configuration files and does not handle credentials or private environment data.
Audit Metadata