Agent skill · Audited from source
agent-ci
skill · redwoodjs/agent-ciNOASSERTION licenceAudited 20 Oct 2026 · source 65eb0af1350c
★ 808pushed 40 days agoversion 1.0.0
Is it safe? No — BLOCK, grade F (52/100). We read this skill's source at commit 65eb0af1350c and observed filesystem, network and shell access and a hard-coded secret (see the findings). The audit raised 25 findings, 2 critical or high. What it does: Run GitHub Actions workflows locally with pause-on-failure for AI-agent-driven CI iteration
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “agent-ci (redwoodjs/agent-ci)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/redwoodjs/agent-ci
Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 2 critical or high findings, starting with “Code injection” in packages/dtu-github-actions/src/server/index.ts:22. Do not install it without reading them.
Trust audit
Audit 0.4.1 · source read 20 Oct 2026
Trust score52/100✕BLOCK F
0 critical2 high14 medium27 low8 info
BLOCK means the audit found something that could harm you or your machine. Grade F is shared by 105 of 14,816 audited skills.
What the source does
- FilesystemDeclared5 observations
- NetworkDeclared8 observations
- ShellDeclared6 observations
- DependenciesNot pinnedSome versions float
- SecretsFoundSee the findings; values are never shown
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 9 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | FAIL | 15 |
L2 Instructions | Prompt injection, authority framing, hidden directives | FAIL | 1 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: instruction override, no behavioural pass.
Findings (25)
HIGHCode injectioncode.eval_exec · packages/dtu-github-actions/src/server/index.ts:22
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(`lsof -t -i:${config.DTU_PORT} | xargs kill -9`, () => resolve());- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
HIGHPrompt injectionprompt.hide_from_user · CLAUDE.md:11
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Before completing any work, validate all workflows against the in-tree dev build. If it fails, fix the issue and re-run. Do not tell the user work is done until it passes.
- Why
- asks the agent to act without the user's knowledge
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · packages/dtu-github-actions/src/server/routes/github.ts:52
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`[DTU] Token exchange for installation: ${installationId}`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · packages/dtu-github-actions/src/server/routes/github.ts:95
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`[DTU] Generating registration token for ${owner}/${repo}`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · packages/dtu-github-actions/src/server/routes/github.ts:109
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`[DTU] Generating registration token for ${owner}/${repo} (v3)`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · scripts/rust-smoke-parity.mjs:415
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`↷ ${workflow.path} skipped: private fixture is not accessible to this token`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · crates/local-ci-runtime/src/docker/tests.rs:418
F-04 Network egressCWE-200 · CWE-319Layer L1
resolve_docker_api_url("http://127.0.0.1:1234", "host.docker.internal"),- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · crates/local-ci-runtime/src/dtu.rs:85
F-04 Network egressCWE-200 · CWE-319Layer L1
url: format!("http://127.0.0.1:{port}"),- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · crates/local-ci-runtime/src/dtu/tests.rs:92
F-04 Network egressCWE-200 · CWE-319Layer L1
assert!(server.url.starts_with("http://127.0.0.1:"));- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · crates/local-ci-runtime/src/macos_vm/tests.rs:172
F-04 Network egressCWE-200 · CWE-319Layer L1
dtu_url: "http://127.0.0.1:3000".to_owned(),
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.base64_blob · crates/local-ci-runtime/src/docker/config.rs:167
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"echo '{{\"agentId\":1,\"agentName\":\"{}\",\"poolId\":1,\"poolName\":\"Default\",\"serverUrl\":\"{}\",\"gitHubUrl\":\"{}/'$GITHUB_REPOSITORY'\",\"workFolder\":\"_work\",\"ephemeral\":true}}' > /home/- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.base64_blob · crates/local-ci/src/run_command/macos_job.rs:245
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"d": "CQpCI+sO2GD1N/JsHHI9zEhMlu5Fcc8mU4O2bO6iscOsagFjvEnTesJgydC/Go1HuOBlx+GT9EG2h7+juS0z2o5n8Mvt5BBxlK+tqoDOs8VfQ9CSUl3hqYRPeNdBfnA1w8ovLW0wqfPO08FWTLI0urYsnwjZ5BQrBM+D7zYeA0aCsKdo75bKmaEKnmqrtIEhb7
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.base64_blob · crates/local-ci/src/run_command/macos_job.rs:250
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"modulus": "x0eoW2DD7xsW5YiorMN8pNHVvZk4ED1SHlA/bmVnRz5FjEDnQloMn0nBgIUHxoNArksknrp/FOVJv5sJHJTiRZkOp+ZmH7d3W3gmw63IxK2C5pV+6xfav9jR2+Wt/6FMYMgG2utBdF95oif1f2XREFovHoXkWms2l0CPLLHVPO44Hh9EEmBmjOeMJEZk
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.base64_blob · packages/cli/src/docker/container-config.ts:182
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
: `echo '{"agentId":1,"agentName":"${containerName}","poolId":1,"poolName":"Default","serverUrl":"${dtuBaseUrl}","gitHubUrl":"${dtuBaseUrl}/'$GITHUB_REPOSITORY'","workFolder":"_work","ephemeral":true}- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.base64_blob · packages/cli/src/runner/runner-credentials.ts:48
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
d: "CQpCI+sO2GD1N/JsHHI9zEhMlu5Fcc8mU4O2bO6iscOsagFjvEnTesJgydC/Go1HuOBlx+GT9EG2h7+juS0z2o5n8Mvt5BBxlK+tqoDOs8VfQ9CSUl3hqYRPeNdBfnA1w8ovLW0wqfPO08FWTLI0urYsnwjZ5BQrBM+D7zYeA0aCsKdo75bKmaEKnmqrtIEhb7hE
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · packages/cli/src/workflow/workflow-parser.test.ts:749
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
API_KEY: "…",
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInventory / provenanceinv.binary · packages/cli/src/log-prune.test.ts
F-13 Inventory / provenanceCWE-1104Layer L0
log-prune.test.ts
- Why
- a compiled or binary member cannot be reviewed from source
- Fix
- ship source, or explain the binary in the README
LOWInventory / provenanceinv.suspicious_name · .notes/peterp/worklogs/2026-02-18-1512-fixing-runner-job-payload.md
F-13 Inventory / provenanceCWE-1104Layer L0
2026-02-18-1512-fixing-runner-job-payload.md
- Why
- member named after an attack tool
- Fix
- remove or justify
LOWInventory / provenanceinv.symlink · .github/fixtures/pnpm-symlinks/packages/pkg-a/types
F-13 Inventory / provenanceCWE-1104Layer L0
.github/fixtures/pnpm-symlinks/packages/pkg-a/types
- Why
- link not followed
- Fix
- —
LOWInventory / provenanceinv.symlink · AGENTS.md
F-13 Inventory / provenanceCWE-1104Layer L0
AGENTS.md
- Why
- link not followed
- Fix
- —
Audit 0.4.1 · source sha 65eb0af1350c · 20 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherredwoodjs GitHub organizationOwner of the repository this skill is read from
- Source folderredwoodjs/agent-ciThe exact folder we audited
- LicenceNOASSERTIONAs the repository states it
- Commit pinned for this verdict65eb0af1350cA new audit runs when the source changes
- Repository statusNot archivedLast push 40 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Run GitHub Actions workflows locally with pause-on-failure for AI-agent-driven CI iteration
--- name: local-ci description: Run GitHub Actions workflows locally with pause-on-failure for AI-agent-driven CI iteration keywords: [github-actions, local-ci, pause-on-failure, ai-agent, runner] --- ## What local-ci does Runs the official GitHub Actions runner binary locally (in Docker), emulating GitHub's cloud API. Cache is bind-mounted (instant). When a step fails, the container pauses — you can fix and retry the failed step without restarting. ## When to use local-ci (not `act`) - You want bit-for-bit compatibility with remote GitHub Actions - You need pause-on-failure for AI agent debugging loops - Cache round-trip speed matters ## Key commands - Run workflow: `npx run-local-ci run --workflow <path>` - Run all relevant workflows (those whose `on` triggers match the current branch/event, just like GitHub): `npx run-local-ci run --all` - Retry after fix: `npx run-local-ci retry --name <runner>` - Abort: `npx run-local-ci abort --name <runner>` ## Agent output mode Pass `--json` (or set `LOCAL_CI_JSON=1`) to emit an NDJSON event stream on stdout — one JSON object per line, with `run.start`/`paused`/`finish`, `job.start`/`finish`, `step.start`/`finish`, and `diagnostic` events. `run.start` carries `schemaVersion: 1`. Pair with `--pause-on-failure`: when stdout isn't a TTY the launcher detaches and the foreground process exits **77** the instant a `run.paused` event fires, so callers can react cleanly without parsing plaintext. ## Common mistakes - Don't push to remote CI to test changes — use `npx run-local-ci run` locally first - Don't use `--from-start` when only the last step failed — use `retry` with no flags to re-run only the failed step - The `AI_AGENT=1` env variable disables animated output for cleaner agent logs - Use `--no-matrix` to collapse matrix jobs into a single run — your local machine is likely faster than GitHub's runners, so parallelizing across matrix combinations is unnecessary
Excerpt, first 1,946 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 65eb0af
npm install npx skills add redwoodjs/local-ci --skill local-ci npm install -g @example/cli npm install --save-dev run-local-ci
git clone https://github.com/redwoodjs/agent-ci git -C agent-ci checkout 65eb0af1350c
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 65eb0af1350c only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Claude Desktop | Mentioned in its text, not tested | Skills for Claude Desktop · About Claude Desktop |
| Codex | Mentioned in its text, not tested | Skills for Codex · About Codex |
| GitHub Copilot | Mentioned in its text, not tested | Skills for GitHub Copilot · About GitHub Copilot |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
Audit history
Every audit, every source change
- ✕BLOCK F 52 / 100
first audit · source
65eb0af1350c
Similar skills
All coding & review skills →architecture-diagram✓SAFE
nousresearch/hermes-agent
Dark-themed SVG architecture/cloud/infra diagrams as HTML.
★ 258kGrade B
arxiv✓SAFE
nousresearch/hermes-agent
Search arXiv papers by keyword, author, category, or ID.
★ 258kGrade B
Blackbox✓SAFE
NousResearch/hermes-agent
Delegate coding tasks to the Blackbox AI multi-model CLI.
★ 248kGrade B
Blender Mcp✓SAFE
NousResearch/hermes-agent
The agent that grows with you
★ 248kGrade B
Evm✓SAFE
NousResearch/hermes-agent
Read-only EVM client: wallets, tokens, gas across 8 chains.
★ 248kGrade B
Honcho✓SAFE
NousResearch/hermes-agent
Configure and troubleshoot Honcho memory for Hermes.
★ 248kGrade B
Questions about agent-ci
What does the agent-ci skill do?
Run GitHub Actions locally — pause on failure, retry in place, and keep caches on your machine.
Is agent-ci safe to install?
No — not without reading the findings first. The audit graded it F (52/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can agent-ci access on my machine?
The audit observed that it reaches the network, runs shell commands and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: found — see the findings.
Which assistants does agent-ci work with?
Its documentation mentions claude-code, claude-desktop, codex, copilot and cursor. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (65eb0af1350c), read on 2026-10-20. The repository is watched, and a new audit runs when it changes — this is the first audit.
Sources
- github.com/redwoodjs/agent-ci — the audited source at commit 65eb0af1350c and every finding aboveObserved · 20 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the agent-ci skill do?
- Is agent-ci safe to install?
- What can agent-ci access on my machine?