workflow-automation

Pass

Audited by Gen Agent Trust Hub on Mar 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill defines several scripts intended for use with the Bash tool to manage local project tasks. The scripts/dev-setup.sh script automates the installation of dependencies, configuration of environment files, and orchestration of Docker services. Additionally, the package.json and Makefile include commands for file system cleanup using rm -rf.
  • [REMOTE_CODE_EXECUTION]: The scripts/deploy.sh template includes instructions for performing remote deployments using ssh. This capability allows the agent to execute a sequence of commands (such as pulling code and restarting services) on external staging or production servers, which represents a significant level of remote infrastructure access.
  • [EXTERNAL_DOWNLOADS]: The skill's workflow frequently utilizes npm install and npm ci to fetch and install third-party dependencies from the public npm registry. It also references official GitHub Actions and third-party integrations, such as codecov-action, for its CI/CD pipeline configuration.
  • [COMMAND_EXECUTION]: The provided scripts reference external dependencies, such as scripts/wait-for-it.sh, which are not included in the skill's source files. These scripts would be executed during the environment setup phase.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 21, 2026, 04:49 AM