dotnet-gha-deploy
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill templates utilize official and verified GitHub Actions from the
actions/,azure/, anddocker/organizations for checkout, build setup, and deployment operations. The use of these well-known services is a standard and safe practice for GitHub Actions workflows.\n- [COMMAND_EXECUTION]: The instructions include standard deployment commands usingdotnet,npm, anddockerCLI tools for building and pushing artifacts. All command execution is scoped to common build and deployment tasks.\n- [INDIRECT_PROMPT_INJECTION]: The provided workflow templates ingest external data from manual inputs (inputs.version,inputs.environment) and GitHub metadata (github.sha,github.event.before) which are interpolated into shell commands. \n - Ingestion points:
SKILL.md(workflow templates for manual rollback and build jobs)\n - Boundary markers: Absent\n
- Capability inventory: Shell script execution (
run), Azure CLI, and Docker CLI\n - Sanitization: Absent; inputs are used directly as parameters for deployment scripts. This is standard functionality for CI/CD templates and evaluated as safe in this context.
Audit Metadata