dotnet-gha-publish
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill correctly uses GitHub Secrets (e.g.,
${{ secrets.NUGET_API_KEY }},${{ secrets.GITHUB_TOKEN }}) for all authentication, avoiding any hardcoded credentials. - [SAFE]: All shell command blocks utilize
set -euo pipefail, which is a security best practice to ensure scripts fail immediately on errors and prevent accidental execution of subsequent commands with invalid data. - [SAFE]: Temporary files containing sensitive data, such as the
.pfxsigning certificate, are stored in${{ runner.temp }}and include an explicit cleanup step usingif: always()to ensure the file is removed regardless of the job outcome. - [SAFE]: The workflows leverage official and well-known GitHub Actions from established organizations for core tasks like checkout, setup, container building, and SBOM generation.
- [SAFE]: The 'Agent Gotchas' section explicitly reinforces security-conscious practices, such as forbidding hardcoded keys and mandating internal cleanup of private key material.
Audit Metadata