mobile-ci-cd
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill sets up CI/CD workflows that ingest data from external sources such as pull request metadata and repository content.
- Ingestion points: GitHub Actions triggers and repository file changes defined in
SKILL.md. - Boundary markers: Not present in the generated YAML templates, which is standard for CI configuration files.
- Capability inventory: Includes file system writes for keystores, command execution via CI tools (npm, flutter, eas), and network operations for builds and store submissions.
- Sanitization: Not explicitly implemented within the provided starter templates.
- [EXTERNAL_DOWNLOADS]: The skill instructions include the use of several external GitHub Actions to facilitate the CI/CD pipeline.
- Fetches official actions from GitHub including
actions/checkout,actions/setup-node, andactions/cache. - Utilizes the official
expo/expo-github-actionfrom the Expo organization. - References well-known community actions such as
subosito/flutter-actionanddorny/paths-filterto handle environment setup and conditional build logic.
Audit Metadata