auditing-gha-settings
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs read-only audits of GitHub Actions settings. It does not modify repository state or handle sensitive user credentials directly.
- [COMMAND_EXECUTION]: The script invokes the GitHub CLI (
gh) to retrieve repository metadata. The execution is scoped to theapisubcommand and uses parameterized arguments passed to the spawn function, which protects against shell injection. - [EXTERNAL_DOWNLOADS]: The skill uses vendor-provided modules from the
@socketsecurity/libscope. It does not pull code from unknown or untrusted third-party registries.
Audit Metadata