github-actions
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides comprehensive educational content regarding GitHub Actions workflow creation and configuration, promoting established best practices.
- [SAFE]: The skill includes a dedicated security guide (references/security-guide.md) that covers essential security topics such as minimizing GITHUB_TOKEN permissions, secure secrets management, OIDC cloud authentication, and preventing command injection.
- [EXTERNAL_DOWNLOADS]: The example workflows demonstrate the use of standard development tools and official GitHub Actions.
- Tools like ruff, black, pytest, mypy, and playwright are used for linting and testing.
- Official actions from actions/, aws-actions/, docker/, and google-github-actions/ are referenced for standard CI/CD operations.
- Security analysis tools including CodeQL, Snyk, Bandit, and Safety are integrated into the documentation.
- These references target well-known services and trusted organizations, which is considered safe practice for documentation skills.
Audit Metadata