infra-ci-cd-docker
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill exclusively promotes industry-standard security practices for containerization. This includes the enforcement of multi-stage builds to minimize image size and eliminate build-time dependencies from production environments.
- [SAFE]: The provided templates mandate the use of non-root users and the dropping of unnecessary Linux capabilities (CAP_DROP: [ALL]) to reduce the attack surface.
- [SAFE]: Secret management is handled correctly using BuildKit secret mounts and Docker secrets, explicitly warning against insecure patterns like using ARG or ENV for sensitive data.
- [SAFE]: All referenced GitHub Actions (e.g., docker/build-push-action, actions/checkout) and container images (e.g., node, postgres, redis, oven/bun) are from well-known, trusted organizations and official repositories.
- [SAFE]: Health check implementations use built-in Node.js functionality rather than external tools like curl or wget, minimizing the tools available within the production container.
Audit Metadata