Generate GitHub Actions workflow YAML files for CI/CD. Use when setting up automated pipelines.

This skill appears to do what it says: run the bundled shell script to produce or inspect GitHub Actions YAML. Before installing or executing, review scripts/script.sh yourself (it is included) to ensure you accept running a local shell script. Note the script will create ~/.local/share/github-actions-gen (benign). The script's templates and help text are simplistic and some listed types/languages are not implemented — expect limited functionality. Only run the skill if you trust the BytesAgain source; avoid running it on repositories with sensitive data unless you inspect its behavior first.

Type: OpenClaw Skill Name: github-actions-gen Version: 3.0.0 The script 'scripts/script.sh' contains multiple shell injection vulnerabilities due to unquoted variables and improper argument handling in functions like 'cmd_lint', 'cmd_optimize', and 'cmd_secrets'. Specifically, the script uses '$2' without quotes in file-system operations and grep commands, which could allow arbitrary command execution if a crafted filename is provided. While these appear to be unintentional logic errors (off-by-one argument indexing after a shift), the high-risk nature of the resulting vulnerabilities meets the criteria for a suspicious classification.