github-workflows
Pass
Audited by Gen Agent Trust Hub on Feb 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE] (SAFE): The skill serves as a comprehensive guide for GitHub Actions development. It explicitly includes security hardening documentation in 'references/best-practices.md' that advises users to avoid common pitfalls like 'pull_request_target' misconfiguration and secret logging. All referenced third-party actions are industry standards (e.g., actions/checkout, docker/build-push-action), and the provided templates use 'permissions: read-all' by default to ensure minimal access. No obfuscation, data exfiltration, or unauthorized command execution was found.
Audit Metadata