Security audit
Security checks for vulnerabilities and agentic risk
This CI helper is mostly coherent, but it can automatically rerun GitHub Actions workflows without clearly asking the user first.
Install only if you are comfortable with the skill using your GitHub CLI session to inspect PR checks and potentially rerun a workflow. Before use, prefer requiring the agent to show the flaky-failure evidence and ask before any gh run rerun command.
The trigger phrases are broad, everyday requests like checking CI or whether something can merge, which increases the chance the skill is invoked in situations the user did not explicitly intend. Because this skill can progress from passive inspection to taking a remote action (gh run rerun), accidental invocation could cause unauthorized or surprising CI reruns and misleading gate decisions.
The skill authorizes a remote CI rerun as part of the default handling strategy for flaky failures without requiring a prior warning or confirmation from the user. This is dangerous because rerunning workflows is a state-changing external action that can consume CI resources, alter audit trails, and violate user expectations if performed automatically.
The description specifies output as “是否可合并” and the entire skill content is written as if Chinese is the required interaction language, with no opt-in or alternative locale described. This can violate language/locale policy when the user has not explicitly chosen Chinese.
No suspicious patterns detected.
