permissioning-ci-workflows
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is educational documentation focused on improving the security posture of CI/CD pipelines. It provides clear instructions on how to use the
permissionsblock to enforce the principle of least privilege. - [PRIVILEGE_ESCALATION]: The content explicitly warns users about privilege escalation risks associated with
pull_request_target. It provides 'BAD' code examples to illustrate how an attacker could execute code in the context of the base repository and explains the correct mitigation strategies. - [CREDENTIALS_UNSAFE]: The skill discusses the lifecycle and visibility of
GITHUB_TOKENand repository secrets. It provides guidance on why secrets should not be passed to untrusted forks, which is a standard security best practice. No hardcoded credentials or exfiltration patterns were found. - [COMMAND_EXECUTION]: Example shell commands such as
gh apiandnpm testare used for instructional purposes to show how to debug permission errors or how a vulnerability might manifest. They are not intended for direct execution by the agent on sensitive data.
Audit Metadata