スキル github-actions

📦

github-actions

Name: github-actions
Author: callstackincubator

コンテンツリビジョン r1 中リスク ⚙️ 外部コマンド📁 ファイルシステムへのアクセス🌐 ネットワークアクセス🔑 環境変数

Build React Native CI Artifacts with GitHub Actions

Mobile teams need repeatable simulator and emulator builds that testers can download. This skill provides reusable GitHub Actions templates and authenticated artifact retrieval examples.

対応: Claude Codex Code(CC)

📊 66 十分

Maintain this Skill? Claim it 📊 66 十分

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "github-actions" from https://skillstore.io/skills/callstackincubator-github-actions.md and its manifest at https://skillstore.io/api/skills/callstackincubator-github-actions/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/callstackincubator-github-actions.md 署名済み manifest GET /api/skills/callstackincubator-github-actions/manifest 署名済み lockfile GET /api/skills/callstackincubator-github-actions/lockfile

テストする

「github-actions」を使用しています。 Plan simulator and emulator builds for a React Native pull request.

期待される結果:

iOS: use a macOS runner, install dependencies, select the shared Xcode scheme, and package the simulator app as a compressed archive.
Android: use a Linux runner with Java 17, install dependencies, and build the Debug APK through the project Gradle wrapper.
Artifacts: retain uploads for seven days and publish names, IDs, and authenticated URLs in the workflow summary.
Security: transfer dynamic inputs through environment variables instead of inserting them directly into Bash source.

「github-actions」を使用しています。 Explain how QA should retrieve a particular build artifact.

期待される結果:

Identify the workflow run and inspect its artifact names, IDs, and expiration status.
Authenticate with GitHub and download by run ID plus artifact name, or use the REST endpoint with the artifact ID.
Confirm the selected artifact matches the intended platform and build configuration before testing.

「github-actions」を使用しています。 Diagnose an Android build that reports an unknown assembledebug task.

期待される結果:

The Gradle variant uses incorrect casing.
Use Debug rather than debug so the generated task matches the project variant.
Check the module name reported by React Native configuration before retrying.

セキュリティ監査

中リスク

v1 • 2026/9/30 バージョン別レポートを開く

Three static findings permit command injection through directly interpolated action inputs; the other 75 matches are legitimate build operations or documentation. A separate semantic finding identifies unchecked multiline values that can overwrite workflow outputs and alter downstream settings. No evidence found of malicious intent, credential exfiltration, or prompt injection.

スキャンされたファイル

735

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (1)

中

references/gha-android-composite-action.md:91-93 references/gha-ios-composite-action.md:133-135 references/gha-workflow-and-downloads.md:136-138 references/gha-workflow-and-downloads.md:199-200

Workflow Output Injection Through Unchecked Line Breaks

Unvalidated identifiers and build inputs are written as single-line GITHUB_OUTPUT entries. Embedded newlines can introduce additional keys or overwrite existing outputs, changing downstream project paths, build selectors, or artifact metadata.

The templates append arbitrary strings with echo and do not reject line breaks. GitHub interprets additional key=value lines as separate outputs; exploitation requires control of those strings.

機能レビュー項目 (3)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

中

references/gha-android-composite-action.md:135

Shell command substitution

VARIANT="$(echo "${{ inputs.variant }}" | tr '[:upper:]' '[:lower:]')"

GitHub substitutes inputs.variant into Bash source before parsing. A caller-supplied command substitution or quote can execute commands; exposure depends on caller input trust.

中

references/gha-ios-composite-action.md:174

Shell command substitution

APP_PATH="$(find "$SEARCH_DIR" -type d -name "${{ inputs.scheme }}.app" | sort | head -n1 || true)"

The scheme input is inserted directly into the find command's Bash source. Shell metacharacters can execute commands if an untrusted caller controls the scheme.

中

references/gha-ios-composite-action.md:205

Shell command substitution

CONFIG="$(echo "${{ inputs.configuration }}" | tr '[:upper:]' '[:lower:]')"

GitHub inserts inputs.configuration directly into Bash before the script runs. Embedded command substitution can execute commands when callers provide untrusted configuration values.

リスク要因

⚙️ 外部コマンド (30)

📁 ファイルシステムへのアクセス (10)

references/gha-android-composite-action.md:79 references/gha-android-composite-action.md:80 references/gha-android-composite-action.md:79 references/gha-android-composite-action.md:80 references/gha-ios-composite-action.md:103 references/gha-ios-composite-action.md:103 references/gha-workflow-and-downloads.md:122 references/gha-workflow-and-downloads.md:122 references/gha-workflow-and-downloads.md:147 references/gha-workflow-and-downloads.md:208

🌐 ネットワークアクセス (4)

references/gha-workflow-and-downloads.md:269 references/gha-workflow-and-downloads.md:275 SKILL.md:47 SKILL.md:48

🔑 環境変数 (2)

references/gha-workflow-and-downloads.md:267 references/gha-workflow-and-downloads.md:273

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/callstackincubator-github-actions/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/callstackincubator-github-actions/security.svg)](https://skillstore.io/skills/callstackincubator-github-actions?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/callstackincubator-github-actions?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/callstackincubator-github-actions/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/callstackincubator-github-actions.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

callstackincubator. (2026). github-actions security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/callstackincubator-github-actions/audits/1

BibTeX形式の引用

@techreport{callstackincubator-callstackincubator-github-actions-2026,
  author = {callstackincubator},
  title = {github-actions security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/callstackincubator-github-actions/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-actions security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "callstackincubator"
date-released: "2026-09-30"
url: "https://skillstore.io/skills/callstackincubator-github-actions/audits/1"
identifiers:
  - type: other
    value: "skillstore:callstackincubator-github-actions:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Create mobile pull request builds

Adapt both composite action templates to produce downloadable iOS simulator apps and Android APKs for pull request validation.

Standardize mobile CI pipelines

Configure runners, dependency installation, build selectors, retention periods, and artifact metadata across both platform jobs.

Retrieve test builds reliably

Use run IDs, artifact names, or artifact IDs to retrieve the correct authenticated build archives for testing.

これらのプロンプトを試す

Understand the build prerequisites

Use github-actions to identify prerequisites for this React Native repository. List required runners, dependencies, the iOS scheme, and the Android variant.

Create an Android build action

Adapt the Android composite action for this repository using the Debug variant. Expose artifact metadata and pass shell inputs through quoted environment variables.

Connect both platform workflows

Create a two-platform workflow using these references. Add pull request and manual triggers, seven-day artifact retention, read-only permissions, and safe shell input handling.

Review artifact retrieval and security

Review this mobile workflow for input injection and artifact selection errors. Propose fixes and authenticated download steps using run IDs and artifact IDs.

ベストプラクティス

Pass dynamic shell values through environment variables, quote expansions, validate build selectors, and reject line breaks in single-line workflow outputs.
Use read-only repository permissions and authenticate artifact downloads with appropriately scoped credentials.
Confirm project schemes and variants, package iOS apps as archives, and retain stable artifact names and IDs.

回避

Insert untrusted action inputs or job outputs directly into Bash source.
Treat authenticated artifact URLs as public download links or expose tokens in logs.
Assume default schemes, module names, variants, and runner toolchains match every repository.

よくある質問

Which AI tools support this skill?

The skill supports Claude, Codex, and Claude Code.

Does this skill run a hosted build service?

No. It provides templates and guidance that you adapt and run through your own GitHub Actions workflows.

Does it produce store-ready mobile releases?

The documented templates target iOS simulator app archives and Android emulator APKs. Store signing and release delivery are not covered.

What runner requirements apply?

iOS requires macOS with Xcode. Android requires a compatible Linux runner, Java 17, the Android SDK, and the project Gradle wrapper.

How can I download a build artifact?

Authenticate with GitHub, then use gh CLI with the run ID and artifact name, or the REST API with the artifact ID.

Can I use the templates unchanged?

Set repository-specific schemes, variants, and dependencies first. Replace direct shell interpolation with environment variables and reject line breaks in single-line outputs.