스킬 github-actions

📦

github-actions

Name: github-actions
Author: callstackincubator

콘텐츠 리비전 r1 중간 위험 ⚙️ 외부 명령어📁 파일 시스템 접근🌐 네트워크 접근🔑 환경 변수

Build React Native CI Artifacts with GitHub Actions

Mobile teams need repeatable simulator and emulator builds that testers can download. This skill provides reusable GitHub Actions templates and authenticated artifact retrieval examples.

지원: Claude Codex Code(CC)

📊 66 적절함

Maintain this Skill? Claim it 📊 66 적절함

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "github-actions" from https://skillstore.io/skills/callstackincubator-github-actions.md and its manifest at https://skillstore.io/api/skills/callstackincubator-github-actions/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/callstackincubator-github-actions.md 서명된 manifest GET /api/skills/callstackincubator-github-actions/manifest 서명된 lockfile GET /api/skills/callstackincubator-github-actions/lockfile

테스트해 보기

"github-actions" 사용 중입니다. Plan simulator and emulator builds for a React Native pull request.

예상 결과:

iOS: use a macOS runner, install dependencies, select the shared Xcode scheme, and package the simulator app as a compressed archive.
Android: use a Linux runner with Java 17, install dependencies, and build the Debug APK through the project Gradle wrapper.
Artifacts: retain uploads for seven days and publish names, IDs, and authenticated URLs in the workflow summary.
Security: transfer dynamic inputs through environment variables instead of inserting them directly into Bash source.

"github-actions" 사용 중입니다. Explain how QA should retrieve a particular build artifact.

예상 결과:

Identify the workflow run and inspect its artifact names, IDs, and expiration status.
Authenticate with GitHub and download by run ID plus artifact name, or use the REST endpoint with the artifact ID.
Confirm the selected artifact matches the intended platform and build configuration before testing.

"github-actions" 사용 중입니다. Diagnose an Android build that reports an unknown assembledebug task.

예상 결과:

The Gradle variant uses incorrect casing.
Use Debug rather than debug so the generated task matches the project variant.
Check the module name reported by React Native configuration before retrying.

보안 감사

중간 위험

v1 • 2026. 9. 30. 버전별 보고서 열기

Three static findings permit command injection through directly interpolated action inputs; the other 75 matches are legitimate build operations or documentation. A separate semantic finding identifies unchecked multiline values that can overwrite workflow outputs and alter downstream settings. No evidence found of malicious intent, credential exfiltration, or prompt injection.

스캔된 파일

735

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (1)

중간

references/gha-android-composite-action.md:91-93 references/gha-ios-composite-action.md:133-135 references/gha-workflow-and-downloads.md:136-138 references/gha-workflow-and-downloads.md:199-200

Workflow Output Injection Through Unchecked Line Breaks

Unvalidated identifiers and build inputs are written as single-line GITHUB_OUTPUT entries. Embedded newlines can introduce additional keys or overwrite existing outputs, changing downstream project paths, build selectors, or artifact metadata.

The templates append arbitrary strings with echo and do not reject line breaks. GitHub interprets additional key=value lines as separate outputs; exploitation requires control of those strings.

기능 검토 항목 (3)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

중간

references/gha-android-composite-action.md:135

Shell command substitution

VARIANT="$(echo "${{ inputs.variant }}" | tr '[:upper:]' '[:lower:]')"

GitHub substitutes inputs.variant into Bash source before parsing. A caller-supplied command substitution or quote can execute commands; exposure depends on caller input trust.

중간

references/gha-ios-composite-action.md:174

Shell command substitution

APP_PATH="$(find "$SEARCH_DIR" -type d -name "${{ inputs.scheme }}.app" | sort | head -n1 || true)"

The scheme input is inserted directly into the find command's Bash source. Shell metacharacters can execute commands if an untrusted caller controls the scheme.

중간

references/gha-ios-composite-action.md:205

Shell command substitution

CONFIG="$(echo "${{ inputs.configuration }}" | tr '[:upper:]' '[:lower:]')"

GitHub inserts inputs.configuration directly into Bash before the script runs. Embedded command substitution can execute commands when callers provide untrusted configuration values.

위험 요인

⚙️ 외부 명령어 (30)

📁 파일 시스템 접근 (10)

references/gha-android-composite-action.md:79 references/gha-android-composite-action.md:80 references/gha-android-composite-action.md:79 references/gha-android-composite-action.md:80 references/gha-ios-composite-action.md:103 references/gha-ios-composite-action.md:103 references/gha-workflow-and-downloads.md:122 references/gha-workflow-and-downloads.md:122 references/gha-workflow-and-downloads.md:147 references/gha-workflow-and-downloads.md:208

🌐 네트워크 접근 (4)

references/gha-workflow-and-downloads.md:269 references/gha-workflow-and-downloads.md:275 SKILL.md:47 SKILL.md:48

🔑 환경 변수 (2)

references/gha-workflow-and-downloads.md:267 references/gha-workflow-and-downloads.md:273

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/callstackincubator-github-actions/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/callstackincubator-github-actions/security.svg)](https://skillstore.io/skills/callstackincubator-github-actions?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/callstackincubator-github-actions?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/callstackincubator-github-actions/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/callstackincubator-github-actions.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

callstackincubator. (2026). github-actions security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/callstackincubator-github-actions/audits/1

BibTeX 인용

@techreport{callstackincubator-callstackincubator-github-actions-2026,
  author = {callstackincubator},
  title = {github-actions security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/callstackincubator-github-actions/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-actions security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "callstackincubator"
date-released: "2026-09-30"
url: "https://skillstore.io/skills/callstackincubator-github-actions/audits/1"
identifiers:
  - type: other
    value: "skillstore:callstackincubator-github-actions:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Create mobile pull request builds

Adapt both composite action templates to produce downloadable iOS simulator apps and Android APKs for pull request validation.

Standardize mobile CI pipelines

Configure runners, dependency installation, build selectors, retention periods, and artifact metadata across both platform jobs.

Retrieve test builds reliably

Use run IDs, artifact names, or artifact IDs to retrieve the correct authenticated build archives for testing.

이 프롬프트를 사용해 보세요

Understand the build prerequisites

Use github-actions to identify prerequisites for this React Native repository. List required runners, dependencies, the iOS scheme, and the Android variant.

Create an Android build action

Adapt the Android composite action for this repository using the Debug variant. Expose artifact metadata and pass shell inputs through quoted environment variables.

Connect both platform workflows

Create a two-platform workflow using these references. Add pull request and manual triggers, seven-day artifact retention, read-only permissions, and safe shell input handling.

Review artifact retrieval and security

Review this mobile workflow for input injection and artifact selection errors. Propose fixes and authenticated download steps using run IDs and artifact IDs.

모범 사례

Pass dynamic shell values through environment variables, quote expansions, validate build selectors, and reject line breaks in single-line workflow outputs.
Use read-only repository permissions and authenticate artifact downloads with appropriately scoped credentials.
Confirm project schemes and variants, package iOS apps as archives, and retain stable artifact names and IDs.

피하기

Insert untrusted action inputs or job outputs directly into Bash source.
Treat authenticated artifact URLs as public download links or expose tokens in logs.
Assume default schemes, module names, variants, and runner toolchains match every repository.

자주 묻는 질문

Which AI tools support this skill?

The skill supports Claude, Codex, and Claude Code.

Does this skill run a hosted build service?

No. It provides templates and guidance that you adapt and run through your own GitHub Actions workflows.

Does it produce store-ready mobile releases?

The documented templates target iOS simulator app archives and Android emulator APKs. Store signing and release delivery are not covered.

What runner requirements apply?

iOS requires macOS with Xcode. Android requires a compatible Linux runner, Java 17, the Android SDK, and the project Gradle wrapper.

How can I download a build artifact?

Authenticate with GitHub, then use gh CLI with the run ID and artifact name, or the REST API with the artifact ID.

Can I use the templates unchanged?

Set repository-specific schemes, variants, and dependencies first. Replace direct shell interpolation with environment variables and reject line breaks in single-line outputs.