github-actions

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill configures several trusted GitHub Actions, including actions/checkout@v4, actions/setup-node@v4, actions/setup-java@v4, and actions/upload-artifact@v4. These are official GitHub actions and fall under the Trusted Organization rule.
  • [EXTERNAL_DOWNLOADS]: Fetches inspiration/references from the callstackincubator GitHub repository, which is recognized as a vendor-owned resource for this domain.
  • [COMMAND_EXECUTION]: Executes standard build environment commands such as npm ci, pod install, ./gradlew, and xcodebuild. These are appropriate for the skill's primary purpose of setting up mobile build pipelines.
  • [COMMAND_EXECUTION]: Uses npx react-native config to dynamically resolve project paths (iOS/Android source directories), ensuring compatibility with custom React Native project structures.
  • [COMMAND_EXECUTION]: Includes inline Python scripts within the workflow to safely parse package.json for Node.js version requirements, which is a standard DevOps pattern.
  • [SAFE]: The skill provides documentation on using the gh CLI and GitHub REST API for artifact retrieval, encouraging secure, authenticated access to build outputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 11:37 AM
Security Audit — agent-trust-hub — github-actions