Skill

watch-github-actions

skill:nvidia/openshell#watch-github-actions

Watch and monitor GitHub Actions workflow runs using the gh CLI. Use when the user wants to check workflow status, watch a running workflow, view CI/CD jobs, or monitor build progress. Trigger keywords - watch pipeline, pipeline status, CI status, check build, monitor CI, view pipeline, pipeline progress, workflow status, actions status.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:21 UTC at fa2d381

findings

high

highest severity

threat classes

2,140

files scanned

48/48

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.agents/skills/watch-github-actions:.agents/skills/watch-github-actions/SKILL.md:195:EXEC
suspicious: finding skill:.agents/skills/watch-github-actions:.agents/skills/watch-github-actions/SKILL.md:199:EXEC

Security findings 2

Code execution

highContextual riskmedium confidence

Undeclared by its watch-and-monitor GitHub Actions description, the skill instructs the agent to dispatch the repository's release.yml workflow (notes-only=true, tag=<stable-tag>) and to trigger a dedicated manual Codex review workflow, i.e. CI-triggering actions beyond monitoring, though fully visible and framed as a benign release-notes preview with promotion/publication skipped.

.agents/skills/watch-github-actions/SKILL.md:195

dispatch `release.yml` with `notes-only=true` and

vector:instruction

Counter-argument considered

Refutation fails on both directions: the dispatch instruction is verbatim in the skill body and concretely addresses the agent, while the declared description covers only watching/monitoring, so triggering workflows is undeclared residue with no applicable carve-out; the notes-only framing and the skipped promotion/publication ('Promotion, tag creation, builds, qualification, and publication are skipped.') mitigate severity but the finding itself already concedes them, so they do not make the claim wrong.

Code execution

highContextual risklow confidence

The skill instructs the agent to dispatch the repository's release.yml workflow with notes-only=true, triggering execution of CI workflow code whose content was served as NOT CONSUMED and is therefore unreviewable in this analysis.

.agents/skills/watch-github-actions/SKILL.md:199

For a release notes preview, dispatch `release.yml` with `notes-only=true` and

vector:instruction

Counter-argument considered

The dispatch instruction is concrete, agent-readable, and goes beyond the declared watch/monitor capability, so no carve-out kills it; the requested release.yml was served NOT CONSUMED, which by rule cannot make the instruction harmless or chain-free, and although the skill openly declares the notes-only scope (undeclared fails), documentation alone does not neutralize a trigger of unreviewed workflow execution, so the low-severity contextual risk stands.

Open questions 6

What the analysis could not settle from the code alone.

Lines 126-243 of SKILL.md ('View Job Logs' through the continuation) embed ~115 lines of repository-specific release-engineering lore (release trains, Codex Security, Trivy, Protobuf Compatibility, Snap Store, secret names like LLM_INFERENCE_API_KEY) that vastly exceeds generic gh CLI usage; the imperatives within are diagnostic/protective ('inspect', 'check', 'never upload the raw scan directory'), so no capability class fits, but confirm this block is host-repo documentation rather than a dilu⟦… 33 more chars …⟧

The frontmatter carries 'metadata: internal: true', an unverifiable status claim; with no harmful behavior present it is not tagged evasion:scanner, but confirm whether it is organizational distribution metadata or a trust signal aimed at reviewers.

Whether the frontmatter 'metadata: internal: true' is a reviewer-directed unverifiable status claim or a benign audience marker; per policy such claims carry zero weight either way, so it is recorded here rather than as a finding.

[file request .agents/skills/release-captain/SKILL.md] SKILL.md (line ~171) says 'see release-captain for disposition' of protobuf compatibility exceptions; does this file exist in the repository, and does its content match the cross-reference without instruction-level steering?

Agent hijacking

[file request .github/workflows/release.yml] The skill instructs dispatching release.yml with notes-only=true and tag=<stable-tag> for a release notes preview; does the workflow accept those inputs and is the described skip-behavior (promotion, tag creation, builds, publication skipped) accurate?

Code execution

[file request .github/workflows/release.yml] What does release.yml do when dispatched with notes-only=true — does it publish artifacts, upload data off-host, or access secrets beyond generating release notes?

Code execution

Coverage gaps 42

Parts of the artifact the static analysis could not fully examine.

context:manifest_unparseable yaml: YAML aliases are not permitted

.github/workflows/build-binaries.yml

context:manifest_unparseable yaml: YAML aliases are not permitted

.github/workflows/build-images.yml