ci-cd
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill provides legitimate templates for CI/CD automation on established platforms like GitHub and GitLab. It correctly promotes security practices such as pinning action versions and utilizing native secrets management.\n- [INDIRECT_PROMPT_INJECTION]: The skill analyzes project files and user requirements to generate configurations, creating an attack surface for indirect injection if project data is malicious.\n
- Ingestion points: Project framework analysis (Step 1) and user-supplied configuration requirements (Usage section).\n
- Boundary markers: No specific delimiters or warnings are used when interpolating project data into the generated YAML templates.\n
- Capability inventory: Generation of executable YAML pipelines and deployment commands (e.g.,
aws ecs,ssh).\n - Sanitization: The workflow relies on platform-native secrets management rather than explicit data sanitization.\n- [CREDENTIALS_UNSAFE]: The provided code examples include hardcoded credentials (e.g., 'testpass') for ephemeral test database services. These are identified as safe placeholders for internal testing environments and do not represent a production credential exposure.
Audit Metadata