github-actions
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill configures several trusted GitHub Actions, including
actions/checkout@v4,actions/setup-node@v4,actions/setup-java@v4, andactions/upload-artifact@v4. These are official GitHub actions and fall under the Trusted Organization rule. - [EXTERNAL_DOWNLOADS]: Fetches inspiration/references from the
callstackincubatorGitHub repository, which is recognized as a vendor-owned resource for this domain. - [COMMAND_EXECUTION]: Executes standard build environment commands such as
npm ci,pod install,./gradlew, andxcodebuild. These are appropriate for the skill's primary purpose of setting up mobile build pipelines. - [COMMAND_EXECUTION]: Uses
npx react-native configto dynamically resolve project paths (iOS/Android source directories), ensuring compatibility with custom React Native project structures. - [COMMAND_EXECUTION]: Includes inline Python scripts within the workflow to safely parse
package.jsonfor Node.js version requirements, which is a standard DevOps pattern. - [SAFE]: The skill provides documentation on using the
ghCLI and GitHub REST API for artifact retrieval, encouraging secure, authenticated access to build outputs.
Audit Metadata