ci-pipeline-and-gates
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is primarily focused on security auditing and hardening of CI/CD environments. Its behavior, including file parsing and execution of local auditing scripts, is transparent and aligns with its stated purpose.
- [COMMAND_EXECUTION]: The skill includes Node.js scripts (
check-workflows.mjs,check-ci-lanes.mjs) designed to perform static analysis on GitHub Actions configuration files. These scripts are intended to be run by the agent or developer to ensure compliance with security standards. - [EXTERNAL_DOWNLOADS]: Documentation within the skill recommends the use of
actionlint, fetching it from its official GitHub repository. This is a standard and safe procedure for enhancing workflow validation. - [INDIRECT_PROMPT_INJECTION]: The auditing scripts ingest and process local
.ymlandpackage.jsonfiles. The skill mitigates risks associated with untrusted data by using a custom, restricted YAML parser that excludes complex features like anchors and aliases, limiting the attack surface.
Audit Metadata