Gh Actions Automation

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.0

Overview

This is a small GitHub Actions workflow helper with no executable code, credential handling, hidden behavior, or unsafe install mechanism found.

Before installing, understand that this helper may cause your agent to draft or edit GitHub Actions workflow files. Review generated YAML, confirm action versions and job permissions, and be careful before adding deployment steps, publishing tokens, or repository secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The skill declares a very generic trigger (`github-actions-helper`) for a broadly applicable task, and the overall description targets common CI/CD requests. This can cause the skill to activate in situations where a general assistant response would be more appropriate, increasing the chance of unintended workflow generation or over-broad tool routing.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The 'When to Use' section relies on broad phrases like 'set up CI' and 'deploy with github actions,' which overlap heavily with ordinary development assistance. Ambiguous activation guidance can cause inappropriate invocation of the skill, leading to misrouting, unnecessary file generation, or application of canned workflows without sufficient project-specific review.

VirusTotal

66/66 vendors flagged this skill as clean.