GitHub Actions Step Flake Audit

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:16 PM UTC
• Version:
  1.0.0

Overview

This skill locally analyzes GitHub Actions JSON exports to identify flaky CI steps and does not show hidden network, credential, persistence, or destructive behavior.

Install if you are comfortable letting the skill read the GitHub Actions JSON files matched by RUN_GLOB. Keep RUN_GLOB narrow, because those exports may include repository names, branches, run IDs, job and step names, and GitHub URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

VirusTotal

64/64 vendors flagged this skill as clean.