gh-actions-debug
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
gh(GitHub CLI) to interact with GitHub APIs and retrieve workflow logs, metadata, and file contents. All commands are targeted at official GitHub API endpoints (repos/{owner}/{repo}/...). - [DATA_EXPOSURE]: The script
fetch-file.shretrieves file contents from a repository at a specific reference. While this accesses code, it is limited to the repository context the user is debugging and uses the user's ownghauthentication. - [OBFUSCATION]: The scripts use
base64 -dto decode GitHub API responses. This is standard practice for handling thecontentfield in GitHub's repository contents API, which is Base64 encoded by default. This is not an attempt to hide malicious code from analysis.
Audit Metadata