📦

github-actions

Name: github-actions
Author: callstackincubator

Ревизия содержимого r1 Средний риск ⚙️ Внешние команды📁 Доступ к файловой системе🌐 Доступ к сети🔑 Переменные окружения

Build React Native CI Artifacts with GitHub Actions

Mobile teams need repeatable simulator and emulator builds that testers can download. This skill provides reusable GitHub Actions templates and authenticated artifact retrieval examples.

Поддерживает: Claude Codex Code(CC)

📊 66 Адекватно

Maintain this Skill? Claim it 📊 66 Адекватно

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "github-actions" from https://skillstore.io/skills/callstackincubator-github-actions.md and its manifest at https://skillstore.io/api/skills/callstackincubator-github-actions/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/callstackincubator-github-actions.md Подписанный manifest GET /api/skills/callstackincubator-github-actions/manifest Подписанный lockfile GET /api/skills/callstackincubator-github-actions/lockfile

Протестировать

Использование «github-actions». Plan simulator and emulator builds for a React Native pull request.

Ожидаемый результат:

iOS: use a macOS runner, install dependencies, select the shared Xcode scheme, and package the simulator app as a compressed archive.
Android: use a Linux runner with Java 17, install dependencies, and build the Debug APK through the project Gradle wrapper.
Artifacts: retain uploads for seven days and publish names, IDs, and authenticated URLs in the workflow summary.
Security: transfer dynamic inputs through environment variables instead of inserting them directly into Bash source.

Использование «github-actions». Explain how QA should retrieve a particular build artifact.

Ожидаемый результат:

Identify the workflow run and inspect its artifact names, IDs, and expiration status.
Authenticate with GitHub and download by run ID plus artifact name, or use the REST endpoint with the artifact ID.
Confirm the selected artifact matches the intended platform and build configuration before testing.

Использование «github-actions». Diagnose an Android build that reports an unknown assembledebug task.

Ожидаемый результат:

The Gradle variant uses incorrect casing.
Use Debug rather than debug so the generated task matches the project variant.
Check the module name reported by React Native configuration before retrying.

Аудит безопасности

Средний риск

v1 • 30.09.2026 Открыть версионный отчет

Three static findings permit command injection through directly interpolated action inputs; the other 75 matches are legitimate build operations or documentation. A separate semantic finding identifies unchecked multiline values that can overwrite workflow outputs and alter downstream settings. No evidence found of malicious intent, credential exfiltration, or prompt injection.

Просканировано файлов

735

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (1)

Средний

references/gha-android-composite-action.md:91-93 references/gha-ios-composite-action.md:133-135 references/gha-workflow-and-downloads.md:136-138 references/gha-workflow-and-downloads.md:199-200

Workflow Output Injection Through Unchecked Line Breaks

Unvalidated identifiers and build inputs are written as single-line GITHUB_OUTPUT entries. Embedded newlines can introduce additional keys or overwrite existing outputs, changing downstream project paths, build selectors, or artifact metadata.

The templates append arbitrary strings with echo and do not reject line breaks. GitHub interprets additional key=value lines as separate outputs; exploitation requires control of those strings.

Пункты проверки возможностей (3)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Средний

references/gha-android-composite-action.md:135

Shell command substitution

VARIANT="$(echo "${{ inputs.variant }}" | tr '[:upper:]' '[:lower:]')"

GitHub substitutes inputs.variant into Bash source before parsing. A caller-supplied command substitution or quote can execute commands; exposure depends on caller input trust.

Средний

references/gha-ios-composite-action.md:174

Shell command substitution

APP_PATH="$(find "$SEARCH_DIR" -type d -name "${{ inputs.scheme }}.app" | sort | head -n1 || true)"

The scheme input is inserted directly into the find command's Bash source. Shell metacharacters can execute commands if an untrusted caller controls the scheme.

Средний

references/gha-ios-composite-action.md:205

Shell command substitution

CONFIG="$(echo "${{ inputs.configuration }}" | tr '[:upper:]' '[:lower:]')"

GitHub inserts inputs.configuration directly into Bash before the script runs. Embedded command substitution can execute commands when callers provide untrusted configuration values.

Факторы риска

⚙️ Внешние команды (30)

📁 Доступ к файловой системе (10)

references/gha-android-composite-action.md:79 references/gha-android-composite-action.md:80 references/gha-android-composite-action.md:79 references/gha-android-composite-action.md:80 references/gha-ios-composite-action.md:103 references/gha-ios-composite-action.md:103 references/gha-workflow-and-downloads.md:122 references/gha-workflow-and-downloads.md:122 references/gha-workflow-and-downloads.md:147 references/gha-workflow-and-downloads.md:208

🌐 Доступ к сети (4)

references/gha-workflow-and-downloads.md:269 references/gha-workflow-and-downloads.md:275 SKILL.md:47 SKILL.md:48

🔑 Переменные окружения (2)

references/gha-workflow-and-downloads.md:267 references/gha-workflow-and-downloads.md:273

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/callstackincubator-github-actions/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/callstackincubator-github-actions/security.svg)](https://skillstore.io/skills/callstackincubator-github-actions?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/callstackincubator-github-actions?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/callstackincubator-github-actions/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/callstackincubator-github-actions.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

callstackincubator. (2026). github-actions security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/callstackincubator-github-actions/audits/1

Цитата BibTeX

@techreport{callstackincubator-callstackincubator-github-actions-2026,
  author = {callstackincubator},
  title = {github-actions security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/callstackincubator-github-actions/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-actions security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "callstackincubator"
date-released: "2026-09-30"
url: "https://skillstore.io/skills/callstackincubator-github-actions/audits/1"
identifiers:
  - type: other
    value: "skillstore:callstackincubator-github-actions:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Create mobile pull request builds

Adapt both composite action templates to produce downloadable iOS simulator apps and Android APKs for pull request validation.

Standardize mobile CI pipelines

Configure runners, dependency installation, build selectors, retention periods, and artifact metadata across both platform jobs.

Retrieve test builds reliably

Use run IDs, artifact names, or artifact IDs to retrieve the correct authenticated build archives for testing.

Попробуйте эти промпты

Understand the build prerequisites

Use github-actions to identify prerequisites for this React Native repository. List required runners, dependencies, the iOS scheme, and the Android variant.

Create an Android build action

Adapt the Android composite action for this repository using the Debug variant. Expose artifact metadata and pass shell inputs through quoted environment variables.

Connect both platform workflows

Create a two-platform workflow using these references. Add pull request and manual triggers, seven-day artifact retention, read-only permissions, and safe shell input handling.

Review artifact retrieval and security

Review this mobile workflow for input injection and artifact selection errors. Propose fixes and authenticated download steps using run IDs and artifact IDs.

Лучшие практики

Pass dynamic shell values through environment variables, quote expansions, validate build selectors, and reject line breaks in single-line workflow outputs.
Use read-only repository permissions and authenticate artifact downloads with appropriately scoped credentials.
Confirm project schemes and variants, package iOS apps as archives, and retain stable artifact names and IDs.

Избегать

Insert untrusted action inputs or job outputs directly into Bash source.
Treat authenticated artifact URLs as public download links or expose tokens in logs.
Assume default schemes, module names, variants, and runner toolchains match every repository.

Часто задаваемые вопросы

Which AI tools support this skill?

The skill supports Claude, Codex, and Claude Code.

Does this skill run a hosted build service?

No. It provides templates and guidance that you adapt and run through your own GitHub Actions workflows.

Does it produce store-ready mobile releases?

The documented templates target iOS simulator app archives and Android emulator APKs. Store signing and release delivery are not covered.

What runner requirements apply?

iOS requires macOS with Xcode. Android requires a compatible Linux runner, Java 17, the Android SDK, and the project Gradle wrapper.

How can I download a build artifact?

Authenticate with GitHub, then use gh CLI with the run ID and artifact name, or the REST API with the artifact ID.

Can I use the templates unchanged?

Set repository-specific schemes, variants, and dependencies first. Replace direct shell interpolation with environment variables and reject line breaks in single-line outputs.