ci-cd-generator
Pass
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: LOW
Full Analysis
- Prompt Injection (SAFE): The prompt uses a standard persona (DevOps expert) and contains no instructions to bypass safety filters or ignore previous rules.
- Data Exposure & Exfiltration (SAFE): No hardcoded credentials or sensitive file paths were detected. The use of
${{ secrets.AZURE_APP_NAME }}and${{ secrets.AZURE_PUBLISH_PROFILE }}represents standard, secure practice for CI/CD templates. - Unverifiable Dependencies & Remote Code Execution (SAFE): The skill does not download or execute any remote scripts. The GitHub Actions referenced in the templates (e.g.,
actions/checkout@v4,azure/webapps-deploy@v2) are from trusted, official organizations. - Indirect Prompt Injection (INFO): The skill processes user-provided project requirements to generate code. While this is an ingestion surface for untrusted data, the skill's role is restricted to text generation for display, and it has no autonomous write or execute capabilities that could be exploited by malicious project descriptions.
- Persistence Mechanisms (SAFE): No attempts to modify shell profiles, cron jobs, or startup services were found.
Audit Metadata