agentic-actions-auditor
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data in the form of GitHub Actions workflow files fetched from local or remote repositories.
- Ingestion points: Workflow content is retrieved using
gh apicalls and local file reads (SKILL.md). - Boundary markers: The instructions explicitly direct the agent to treat all fetched YAML as data and never as code. It provides specific 'Bash Safety Rules' to maintain boundaries between data and the execution environment.
- Capability inventory: The skill utilizes
gh apifor network data retrieval andglobfor local file system discovery. - Sanitization: The methodology includes a dedicated section of prohibitions against piping fetched content to interpreters (bash, python, node) or using it in command substitution, mitigating the risk of executing instructions contained within the analyzed files.
- [EXTERNAL_DOWNLOADS]: The skill uses the official GitHub CLI (
gh api) to fetch configuration and workflow files from GitHub's infrastructure. This interaction targets a well-known service and is fundamental to the skill's stated purpose of auditing remote repositories.
Audit Metadata