GitHub Actions Rerun Waste Audit

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:15 PM UTC
• Version:
  1.0.0

Overview

This skill is a focused local reporting tool that reads GitHub Actions run JSON files and reports rerun waste without network access, persistence, or credential handling.

Install this if you want a local CI rerun-waste report. Before running it, point RUN_GLOB only at GitHub Actions exports you intend to analyze, and avoid publishing the generated output if repository names, branches, commit SHAs, run IDs, or job URLs are sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This code opens local run artifact files and extracts metadata such as repository name, branch, commit SHA, and URLs, then later prints or emits them in output. For a code file, SQP-2 applies when data-handling behavior lacks any visible disclosure in prompts, comments, or docstrings, and this script contains no in-file warning that these fields will be surfaced.

VirusTotal

59/59 vendors flagged this skill as clean.