The 26 backtick alerts are Markdown formatting, while the example URL, local workflow path, and scoped GITHUB_TOKEN are benign template constructs. The AWS example promotes long-lived cloud credentials, and mutable third-party action references create a high-confidence CI supply-chain risk. Replace static AWS keys and pin actions before publication.
The templates execute third-party actions through mutable version and master references. A compromised upstream ref could run attacker-controlled code with workflow tokens or secrets.
The cited lines directly use third-party actions with mutable refs, including two master refs. GitHub Actions resolves those refs to changeable upstream code.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The deployment template instructs users to authenticate AWS with a long-lived access key stored in GitHub Secrets. Compromise or accidental exposure grants persistent cloud access.
The template passes a long-lived AWS secret key to a third-party action. An OIDC role would avoid storing persistent cloud credentials in the repository.
Static detections are mostly false positives from Markdown code fences, template paths, and GitHub Actions secret placeholders. No prompt injection, data exfiltration intent, or skill runtime command execution was found in SKILL.md. One semantic issue remains: security scan examples use mutable third-party action refs that should be pinned.
The security scanning workflow uses third-party actions from mutable master branches. Those refs can change without review and execute code in CI.
The template directly shows external actions using @master refs. This is a known CI supply-chain risk and is not covered by the static hardcoded URL finding.
The static command, filesystem, network, and token matches are documentation examples or placeholders in SKILL.md, not executable skill behavior. The main confirmed issue is a semantic workflow security concern: mutable @master action references in the security scanning template. Authors should pin actions, prefer short-lived cloud authentication, and include or remove missing referenced assets.
The security scanning workflow recommends aquasecurity/trivy-action@master and snyk/actions/node@master. Mutable branch references can change without review and create supply-chain risk if copied into production workflows.
The file explicitly uses two third-party actions pinned to the mutable master branch in a security workflow example. This conflicts with the nearby best practice to use specific action versions.
The static command-execution and credential findings are mostly false positives from Markdown GitHub Actions examples. A real medium-risk issue remains because two third-party Actions are pinned to master, which can change without review.
The security scan examples use aquasecurity/trivy-action@master and snyk/actions/node@master. Branch references can change without review and may introduce supply-chain risk in generated workflows.
The lines directly reference third-party Actions through the mutable master branch. This is a known CI supply-chain risk, although it appears to be an insecure template choice rather than malicious intent.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Workflow Secret Placeholders Are Documented Examples
The GitHub and AWS token references use GitHub Actions secrets syntax in workflow templates. This is expected for CI/CD examples, but users must manage these secrets securely.
The credential references are placeholders under GitHub Actions with: blocks. I found no evidence that the skill reads or exfiltrates local environment variables.
The hidden path detection points to ./.github/workflows/reusable-test.yml. This is the standard location for reusable GitHub Actions workflows.
The path is a conventional repository workflow path. I found no evidence of hidden file harvesting or unauthorized filesystem access.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Markdown Examples Misclassified as Shell Execution
The external command detections occur in Markdown code fences, resource references, or related skill names. I found no evidence that the skill itself executes Ruby, shell commands, or user-controlled input.
The cited lines are documentation or YAML workflow snippets inside SKILL.md. They are not executable code in the skill runtime.
The hardcoded URL is a deployment environment example using https://app.example.com. I found no evidence of data transfer to an attacker-controlled endpoint.
The domain is the reserved example.com domain and appears inside a GitHub Actions environment field. It is documentation, not active network code.
The weak cryptography alerts appear to match ordinary words in the skill description, kubectl describe command, and related skill name. I found no cryptographic implementation.
The cited lines contain prose or Kubernetes commands, not hash, cipher, or signing logic. The static signal is a lexical false positive.
This skill is documentation-only containing GitHub Actions YAML workflow templates. All static analysis findings are false positives: the detected 'external_commands' are YAML run: syntax in markdown code blocks, 'network' references are URL configuration values, 'filesystem' patterns are reusable workflow references, and 'env_access' patterns are GitHub Actions secret syntax (${{ secrets.* }}). No executable code, no prompt injection attempts, and no security risks detected. The skill teaches legitimate DevOps practices including proper secret handling and secure workflow patterns.
1
Files scanned
348
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.