github-contribution-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill defines a set of commands for the
ghCLI andgitto manage repository contributions. These are standard developer operations intended to facilitate PR and issue management. - [CREDENTIALS_UNSAFE]: The skill identifies the risk of leaking secrets in shell history or process logs when using
gh secret set. It provides specific remediation by instructing the agent to use interactive modes or file redirection rather than command-line arguments. - [PRIVILEGE_ESCALATION]: The skill allows the use of
--no-verifyfor specific non-code commits (like submodule pin bumps). It includes a warning to never use this for code commits to avoid bypassing repository safety hooks.
Audit Metadata