skills/schalkneethling/create-project-calavera/npm-trusted-publishing-github-workflow/Gen Agent Trust Hub
npm-trusted-publishing-github-workflow
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard shell commands for development workflows, such as
grep,ruby, andpnpmfor configuration validation and package preparation. - [DYNAMIC_EXECUTION]: The workflow template includes a Node.js script executed via a shell heredoc to perform semantic version comparison. This is a functional utility for ensuring the environment meets the minimum requirements for OIDC publishing and does not pose a security risk as the script logic is static and visible.
- [EXTERNAL_DOWNLOADS]: The skill references official GitHub Actions (
actions/checkout,actions/upload-artifact, etc.) and the well-knownpnpm/setupaction from the pnpm organization. These are standard and trusted components for CI/CD pipelines. - [SAFE]: The skill promotes significant security hardening by mandating full commit SHA pinning for all GitHub Actions, requiring explicit least-privilege
GITHUB_TOKENpermissions, and encouraging the transition from sensitive tokens to OIDC-based trusted publishing.
Audit Metadata