agentic-actions-auditor
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect prompt injection risk. The skill fetches and analyzes GitHub Actions workflow files from external or local repositories, creating an ingestion point for attacker-controlled input.
- Ingestion points: Workflow files are fetched from GitHub via 'gh api' in Step 0 or read locally via Glob in Step 1.
- Boundary markers: The skill includes a 'Bash Safety Rules' section that explicitly instructs the agent to treat fetched YAML as data and never execute it.
- Capability inventory: The skill utilizes 'gh api' for network/CLI execution and file system read access to perform its audit.
- Sanitization: The skill relies on instructional guards to prevent the agent from misinterpreting data as executable code or prompt overrides.
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI ('gh api') to interact with remote repositories for metadata and file contents. This represents the legitimate use of a well-known tool for the skill's primary stated purpose.
Audit Metadata