actionlint
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to fetch the actionlint binary from its official GitHub release page (https://api.github.com/repos/rhysd/actionlint/releases/latest) using curl.\n- [REMOTE_CODE_EXECUTION]: The skill installs the actionlint utility by piping a downloaded tarball into the tar command to extract a binary directly into /usr/local/bin.\n- [COMMAND_EXECUTION]: The skill executes shell commands to check for the presence of actionlint, determine version information, and run the validation tool against YAML workflow files.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes GitHub Actions workflow files which are untrusted external data.\n
- Ingestion points: Workflow files located in .github/workflows/*.yml or specific paths provided to the agent.\n
- Boundary markers: Absent; the skill does not include specific delimiters or instructions for the agent to ignore commands within the workflow files.\n
- Capability inventory: The skill executes shell commands to perform linting and reports the results to the agent.\n
- Sanitization: Absent; the agent reports the linter's output directly to the user.
Audit Metadata