📦

github-actions

Name: github-actions
Author: callstackincubator

Revisão do conteúdo r1 Risco Médio ⚙️ Comandos externos📁 Acesso ao sistema de arquivos🌐 Acesso à rede🔑 Variáveis de ambiente

Build React Native CI Artifacts with GitHub Actions

Mobile teams need repeatable simulator and emulator builds that testers can download. This skill provides reusable GitHub Actions templates and authenticated artifact retrieval examples.

Suporta: Claude Codex Code(CC)

📊 66 Adequado

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "github-actions" from https://skillstore.io/skills/callstackincubator-github-actions.md and its manifest at https://skillstore.io/api/skills/callstackincubator-github-actions/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/callstackincubator-github-actions.md manifest assinado GET /api/skills/callstackincubator-github-actions/manifest lockfile assinado GET /api/skills/callstackincubator-github-actions/lockfile

Testar

Usando "github-actions". Plan simulator and emulator builds for a React Native pull request.

Resultado esperado:

iOS: use a macOS runner, install dependencies, select the shared Xcode scheme, and package the simulator app as a compressed archive.
Android: use a Linux runner with Java 17, install dependencies, and build the Debug APK through the project Gradle wrapper.
Artifacts: retain uploads for seven days and publish names, IDs, and authenticated URLs in the workflow summary.
Security: transfer dynamic inputs through environment variables instead of inserting them directly into Bash source.

Usando "github-actions". Explain how QA should retrieve a particular build artifact.

Resultado esperado:

Identify the workflow run and inspect its artifact names, IDs, and expiration status.
Authenticate with GitHub and download by run ID plus artifact name, or use the REST endpoint with the artifact ID.
Confirm the selected artifact matches the intended platform and build configuration before testing.

Usando "github-actions". Diagnose an Android build that reports an unknown assembledebug task.

Resultado esperado:

The Gradle variant uses incorrect casing.
Use Debug rather than debug so the generated task matches the project variant.
Check the module name reported by React Native configuration before retrying.

Auditoria de segurança

Risco Médio

v1 • 30/09/2026 Abrir o relatório versionado

Three static findings permit command injection through directly interpolated action inputs; the other 75 matches are legitimate build operations or documentation. A separate semantic finding identifies unchecked multiline values that can overwrite workflow outputs and alter downstream settings. No evidence found of malicious intent, credential exfiltration, or prompt injection.

Arquivos analisados

735

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (1)

Médio

references/gha-android-composite-action.md:91-93 references/gha-ios-composite-action.md:133-135 references/gha-workflow-and-downloads.md:136-138 references/gha-workflow-and-downloads.md:199-200

Workflow Output Injection Through Unchecked Line Breaks

Unvalidated identifiers and build inputs are written as single-line GITHUB_OUTPUT entries. Embedded newlines can introduce additional keys or overwrite existing outputs, changing downstream project paths, build selectors, or artifact metadata.

The templates append arbitrary strings with echo and do not reject line breaks. GitHub interprets additional key=value lines as separate outputs; exploitation requires control of those strings.

Itens de revisão de capacidade (3)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

references/gha-android-composite-action.md:135

Shell command substitution

VARIANT="$(echo "${{ inputs.variant }}" | tr '[:upper:]' '[:lower:]')"

GitHub substitutes inputs.variant into Bash source before parsing. A caller-supplied command substitution or quote can execute commands; exposure depends on caller input trust.

Médio

references/gha-ios-composite-action.md:174

Shell command substitution

APP_PATH="$(find "$SEARCH_DIR" -type d -name "${{ inputs.scheme }}.app" | sort | head -n1 || true)"

The scheme input is inserted directly into the find command's Bash source. Shell metacharacters can execute commands if an untrusted caller controls the scheme.

Médio

references/gha-ios-composite-action.md:205

Shell command substitution

CONFIG="$(echo "${{ inputs.configuration }}" | tr '[:upper:]' '[:lower:]')"

GitHub inserts inputs.configuration directly into Bash before the script runs. Embedded command substitution can execute commands when callers provide untrusted configuration values.

Fatores de risco

⚙️ Comandos externos (30)

📁 Acesso ao sistema de arquivos (10)

references/gha-android-composite-action.md:79 references/gha-android-composite-action.md:80 references/gha-android-composite-action.md:79 references/gha-android-composite-action.md:80 references/gha-ios-composite-action.md:103 references/gha-ios-composite-action.md:103 references/gha-workflow-and-downloads.md:122 references/gha-workflow-and-downloads.md:122 references/gha-workflow-and-downloads.md:147 references/gha-workflow-and-downloads.md:208

🌐 Acesso à rede (4)

references/gha-workflow-and-downloads.md:269 references/gha-workflow-and-downloads.md:275 SKILL.md:47 SKILL.md:48

🔑 Variáveis de ambiente (2)

references/gha-workflow-and-downloads.md:267 references/gha-workflow-and-downloads.md:273

Auditado por: codex

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/callstackincubator-github-actions/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/callstackincubator-github-actions/security.svg)](https://skillstore.io/skills/callstackincubator-github-actions?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/callstackincubator-github-actions?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/callstackincubator-github-actions/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/callstackincubator-github-actions.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

callstackincubator. (2026). github-actions security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/callstackincubator-github-actions/audits/1

Citação BibTeX

@techreport{callstackincubator-callstackincubator-github-actions-2026,
  author = {callstackincubator},
  title = {github-actions security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/callstackincubator-github-actions/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-actions security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "callstackincubator"
date-released: "2026-09-30"
url: "https://skillstore.io/skills/callstackincubator-github-actions/audits/1"
identifiers:
  - type: other
    value: "skillstore:callstackincubator-github-actions:audit:1"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Create mobile pull request builds

Adapt both composite action templates to produce downloadable iOS simulator apps and Android APKs for pull request validation.

Standardize mobile CI pipelines

Configure runners, dependency installation, build selectors, retention periods, and artifact metadata across both platform jobs.

Retrieve test builds reliably

Use run IDs, artifact names, or artifact IDs to retrieve the correct authenticated build archives for testing.

Teste estes prompts

Understand the build prerequisites

Use github-actions to identify prerequisites for this React Native repository. List required runners, dependencies, the iOS scheme, and the Android variant.

Create an Android build action

Adapt the Android composite action for this repository using the Debug variant. Expose artifact metadata and pass shell inputs through quoted environment variables.

Connect both platform workflows

Create a two-platform workflow using these references. Add pull request and manual triggers, seven-day artifact retention, read-only permissions, and safe shell input handling.

Review artifact retrieval and security

Review this mobile workflow for input injection and artifact selection errors. Propose fixes and authenticated download steps using run IDs and artifact IDs.

Boas práticas

Pass dynamic shell values through environment variables, quote expansions, validate build selectors, and reject line breaks in single-line workflow outputs.
Use read-only repository permissions and authenticate artifact downloads with appropriately scoped credentials.
Confirm project schemes and variants, package iOS apps as archives, and retain stable artifact names and IDs.

Evitar

Insert untrusted action inputs or job outputs directly into Bash source.
Treat authenticated artifact URLs as public download links or expose tokens in logs.
Assume default schemes, module names, variants, and runner toolchains match every repository.

Perguntas frequentes

Which AI tools support this skill?

The skill supports Claude, Codex, and Claude Code.

Does this skill run a hosted build service?

No. It provides templates and guidance that you adapt and run through your own GitHub Actions workflows.

Does it produce store-ready mobile releases?

The documented templates target iOS simulator app archives and Android emulator APKs. Store signing and release delivery are not covered.

What runner requirements apply?

iOS requires macOS with Xcode. Android requires a compatible Linux runner, Java 17, the Android SDK, and the project Gradle wrapper.

How can I download a build artifact?

Authenticate with GitHub, then use gh CLI with the run ID and artifact name, or the REST API with the artifact ID.

Can I use the templates unchanged?

Set repository-specific schemes, variants, and dependencies first. Replace direct shell interpolation with environment variables and reject line breaks in single-line outputs.