develop-ci-pipelines
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents security best practices for CI/CD environments and does not contain malicious code or patterns.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted CI configuration data (YAML files) from external repositories. The instructions include defensive measures such as quoting shell expansions and using environment variables for untrusted inputs to prevent injection within the generated CI workflows.
- [REMOTE_CODE_EXECUTION]: The skill references external GitHub Actions but correctly pins them to full commit SHAs rather than mutable tags, following supply chain security best practices for remote code usage.
Audit Metadata