github-script
Pass
Audited by Gen Agent Trust Hub on Mar 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes reusable script logic in
version-check-shared.mjsthat executes theuvCLI via the@actions/exectoolkit. This is used for package version validation. - [PROMPT_INJECTION]: Documentation in
references/security.mdprovides detailed guidance on preventing script injection. It correctly identifies the risk of direct${{ ... }}interpolation and recommends using environment variables or thecontextobject as a secure alternative. - [SAFE]: All external module references, such as the
@actions/github-scriptdependency inpackage.json, target official and trusted GitHub repositories. - [COMMAND_EXECUTION]: The skill demonstrates and recommends the use of dynamic
import()calls to load local ESM modules from the GitHub workspace, facilitating code reuse and maintainability in CI/CD pipelines.
Audit Metadata