github-actions-efficiency
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
ghCLI andrgutility to audit repository workflows and run history. - Evidence: Executes commands such as
rg -n "on:|concurrency:|..." .github/workflows,gh run list, andgh run view "$run_id" --log-failedto identify efficiency bottlenecks. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from workflow files and CI logs, which could be used to influence the agent's behavior if an attacker can control the content of these sources (e.g., via log poisoning from a malicious PR).
- Ingestion points: Processes contents of
.github/workflows/and output fromgh run view --log-failed(SKILL.md). - Boundary markers: Absent; the skill does not use specific delimiters or instructions to ignore embedded commands within the logs.
- Capability inventory: The skill is capable of proposing workflow modifications and performing live validation using
git pushon non-protected branches (SKILL.md). - Sanitization: No sanitization or filtering logic is specified for the ingested log data.
Audit Metadata