github-actions-efficiency

Pass

Audited by Gen Agent Trust Hub on Aug 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the gh CLI and rg utility to audit repository workflows and run history.
  • Evidence: Executes commands such as rg -n "on:|concurrency:|..." .github/workflows, gh run list, and gh run view "$run_id" --log-failed to identify efficiency bottlenecks.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from workflow files and CI logs, which could be used to influence the agent's behavior if an attacker can control the content of these sources (e.g., via log poisoning from a malicious PR).
  • Ingestion points: Processes contents of .github/workflows/ and output from gh run view --log-failed (SKILL.md).
  • Boundary markers: Absent; the skill does not use specific delimiters or instructions to ignore embedded commands within the logs.
  • Capability inventory: The skill is capable of proposing workflow modifications and performing live validation using git push on non-protected branches (SKILL.md).
  • Sanitization: No sanitization or filtering logic is specified for the ingested log data.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 29, 2026, 05:42 PM
Security Audit — agent-trust-hub — github-actions-efficiency