GitHub Actions Generator

生成 GitHub Actions 工作流，支持 CI/CD、测试、部署等多种场景。

Security Scan

The skill's description and usage examples claim many features (multi-language CI, Docker push, releases, Dependabot, schedules), but the shipped code is a tiny Bash script that only generates two Node-focused workflows and does not implement the claimed features or flags — the package is therefore misleading/inconsistent.

Purpose & Capability

The SKILL.md and description promise broad GitHub Actions generation (Node/Python/Go, Docker build & push, auto release, Dependabot, scheduled tasks). The included script only writes two simple workflows (ci.yml and deploy.yml), both Node-centric; it does not implement Docker, releases, Dependabot, schedules, or the CLI flags shown in the README. This is a capability mismatch and likely misleading.

Instruction Scope

Runtime instructions and usage examples show flags (e.g., --lang, --target, --registry) and multiple scenarios that the code does not support. The actual script accepts positional args ($1, $2) and ignores GNU-style flags; it only creates .github/workflows/ci.yml or deploy.yml and will overwrite those files if present. The instructions therefore overstate what the runtime will do.

Install Mechanism

No install spec and only an included bash script — nothing is downloaded from external URLs. This is low-risk from an install-perspective: code is included in the skill bundle and no network install steps are present.

Credentials

The skill requests no environment variables or credentials (correct for the provided script). However, the SKILL.md claims features that typically require credentials (e.g., pushing to registries, creating Releases, Dependabot configuration) but the skill does not request or document the needed tokens — another sign of inconsistency.

Persistence & Privilege

Skill is not always-on and does not request elevated platform privileges. It only writes workflow files into the repository (expected for a generator). There is no evidence it modifies other skills or system-wide agent settings.

What to consider before installing

This skill appears misleading: its README lists many features and CLI flags that are not implemented in the included script. If you consider installing or running it, do the following first: - Inspect the github-actions-generator.sh content (already included) and confirm it does what you need. It currently only writes two Node-focused workflows. - Run it in a throwaway repository or branch (not your main production repo), and back up any existing .github/workflows files because the script will overwrite ci.yml or deploy.yml. - If you need Docker pushes, Releases, Dependabot, or multi-language support, request an updated implementation that actually requires and documents the necessary credentials (e.g., GH_TOKEN, registry credentials) and show how flags are parsed. - Do not run this on a sensitive repo until you verify the generated workflows and the script behavior. The package appears non-malicious but is inconsistent and incomplete.

自动生成 GitHub Actions 工作流文件。

支持的场景

• ✅ Node.js CI/CD
• ✅ Python CI/CD
• ✅ Go CI/CD
• ✅ Docker 构建推送
• ✅ 自动发布 Release
• ✅ Dependabot 自动更新
• ✅ 定时任务

使用方法

github-actions-generator ci --lang node
github-actions-generator deploy --target vercel
github-actions-generator docker --registry ghcr