compose-preview-ci
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to configure workflows that fetch composite actions and CLI tools from the author's public GitHub repository (
yschimke/compose-ai-tools). These are legitimate vendor resources required for the skill's functionality. - [PRIVILEGE_ESCALATION]: The documentation explicitly warns against using
pull_request_targetfor rendering untrusted code, which is a common vector for credential theft. It provides a secure alternative using a two-stage 'render/publish' split to isolate untrusted code execution from sensitive write tokens. - [COMMAND_EXECUTION]: The provided workflow templates execute standard development tools including Gradle, Java, and the
actions/checkoutaction to manage the build pipeline.
Audit Metadata