mobile-ci-cd

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill sets up CI/CD workflows that ingest data from external sources such as pull request metadata and repository content.
  • Ingestion points: GitHub Actions triggers and repository file changes defined in SKILL.md.
  • Boundary markers: Not present in the generated YAML templates, which is standard for CI configuration files.
  • Capability inventory: Includes file system writes for keystores, command execution via CI tools (npm, flutter, eas), and network operations for builds and store submissions.
  • Sanitization: Not explicitly implemented within the provided starter templates.
  • [EXTERNAL_DOWNLOADS]: The skill instructions include the use of several external GitHub Actions to facilitate the CI/CD pipeline.
  • Fetches official actions from GitHub including actions/checkout, actions/setup-node, and actions/cache.
  • Utilizes the official expo/expo-github-action from the Expo organization.
  • References well-known community actions such as subosito/flutter-action and dorny/paths-filter to handle environment setup and conditional build logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 07:49 AM
Security Audit — agent-trust-hub — mobile-ci-cd