github-presence
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides configuration templates that reference several third-party GitHub Actions, including
gautamkrishnar/blog-post-workflow,lowlighter/metrics, andethomson/send-tweet-action. These are well-known community actions used for the stated purposes of automating README updates and marketing tasks. - [COMMAND_EXECUTION]: The provided GitHub Action examples include shell commands for repository automation, such as
git config,git commit, andgit push. These commands are localized to the action's runner environment and are necessary for the skill's functionality to update the project's README file automatically. - [INDIRECT_PROMPT_INJECTION]: The skill describes a method for ingesting external data (e.g., blog feeds) into the repository README. While this creates a surface for external content to enter the project environment, it follows standard automation patterns and is intended for user-controlled data sources.
- [SAFE]: The skill encourages the use of GitHub Secrets for sensitive information like API tokens (
METRICS_TOKEN,TWITTER_CONSUMER_KEY), which is a best practice for secure credential management in CI/CD workflows.
Audit Metadata