菜单
Expert knowledge in GitHub Agentic Workflows safe outputs - security architecture, sanitization, controlled AI actions, and write operation patterns
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Hack23/riksdagsmonitor --skill gh-aw-safe-outputs命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | gh-aw-safe-outputs |
| description | Expert knowledge in GitHub Agentic Workflows safe outputs - security architecture, sanitization, controlled AI actions, and write operation patterns |
| license | Apache-2.0 |
| version | 2.0.1 |
| last_updated | "2026-04-13T00:00:00.000Z" |
| tags | ["github-agentic-workflows","safe-outputs","security","ai-safety","sanitization"] |
Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.
Master the safe outputs pattern in GitHub Agentic Workflows - the foundational security mechanism that enables AI agents to perform write operations safely through explicit, human-approved outputs. This skill provides comprehensive expertise in designing, implementing, and operating safe output patterns for controlled AI automation.
Safe outputs are the only way AI agents can perform write operations (create/update files, issues, PRs) in GitHub Agentic Workflows. Unlike direct tool access, safe outputs require explicit approval and sanitization before execution.
Key Principles:
Security Model:
┌─────────────┐ ┌──────────────┐ ┌─────────────────┐
│ │ │ │ │ │
│ AI Agent │─────▶│ Safe Outputs │─────▶│ Sanitization │
│ (Read-Only) │ │ (Declare) │ │ & Execution │
│ │ │ │ │ │
└─────────────┘ └──────────────┘ └─────────────────┘
│
▼
┌──────────────┐
│ Workflow │
│ Configuration│
│ (Allowlist) │
└──────────────┘
safeoutputs___issueCreate or update GitHub issues with AI-generated content.
Configuration:
tools:
safeoutputs___issue:
# No additional config required
Usage Pattern:
# Workflow markdown body
Analyze this codebase and create issues for improvement opportunities.
For each issue, use safeoutputs___issue:
- title: Brief description
- body: Detailed explanation with code examples
- labels: ["enhancement", "ai-generated"]
AI Output Format:
{
"tool": "safeoutputs___issue",
"title": "Improve error handling in authentication module",
"body": "## Problem\n\nThe authentication module lacks comprehensive error handling...\n\n## Proposed Solution\n\n1. Add try-catch blocks\n2. Implement error logging\n3. Return user-friendly messages",
"labels": ["enhancement", "security"]
}
Sanitization Applied:
Execution:
safeoutputs___pull_requestCreate pull requests with AI-generated code changes.
Configuration:
tools:
safeoutputs___pull_request:
base_branch: main # Optional: default branch
auto_merge: false # Optional: enable auto-merge
Usage Pattern:
Review this codebase and propose improvements.
Create a pull request using safeoutputs___pull_request:
- branch: "ai/improve-error-handling"
- title: "Improve error handling"
- body: Description of changes
- files: List of file changes
AI Output Format:
{
"tool": "safeoutputs___pull_request",
"branch": "ai/improve-error-handling",
"title": "Improve error handling in authentication module",
"body": "## Changes\n\n- Added try-catch blocks\n- Implemented error logging\n- Added tests",
"files": [
{
"path": "src/auth.ts",
"content": "// New content...",
"encoding": "utf-8"
}
]
}
Sanitization Applied:
Execution:
safeoutputs___commentAdd comments to issues or pull requests.
Configuration:
tools:
safeoutputs___comment:
# No additional config required
Usage Pattern:
Provide helpful feedback on this pull request.
Add a comment using safeoutputs___comment:
- issue_number: 123 # or pr_number
- body: Your feedback
AI Output Format:
{
"tool": "safeoutputs___comment",
"issue_number": 123,
"body": "## Code Review\n\nI noticed a few areas for improvement:\n\n1. **Error Handling**: Consider adding...\n2. **Performance**: The loop in line 45 could be optimized..."
}
Sanitization Applied:
safeoutputs___fileCreate or update files in the repository.
Configuration:
tools:
safeoutputs___file:
allowed_paths:
- "docs/**"
- "*.md"
- "src/**/*.ts"
max_file_size: 1048576 # 1MB
Usage Pattern:
Update documentation to reflect recent changes.
Create/update files using safeoutputs___file:
- path: docs/api.md
- content: Updated documentation
- commit_message: Update API documentation
AI Output Format:
{
"tool": "safeoutputs___file",
"path": "docs/api.md",
"content": "# API Documentation\n\n## Authentication\n\n...",
"commit_message": "Update API documentation with new endpoints",
"encoding": "utf-8"
}
Sanitization Applied:
safeoutputs___labelAdd or remove labels from issues or pull requests.
Configuration:
tools:
safeoutputs___label:
# No additional config required
Usage Pattern:
Triage this issue and apply appropriate labels.
Use safeoutputs___label:
- issue_number: 123
- add: ["bug", "high-priority"]
- remove: ["needs-triage"]
AI Output Format:
{
"tool": "safeoutputs___label",
"issue_number": 123,
"add": ["bug", "high-priority"],
"remove": ["needs-triage"]
}
Sanitization Applied:
safeoutputs___noopNo operation - AI provides information without taking action.
Configuration:
tools:
safeoutputs___noop:
# Always available, no config
Usage Pattern:
Analyze this issue and provide recommendations without taking action.
Use safeoutputs___noop to report findings.
AI Output Format:
{
"tool": "safeoutputs___noop",
"message": "## Analysis\n\nThis issue appears to be a duplicate of #456.\n\n## Recommendation\n\nClose this issue and direct the reporter to #456."
}
Use Cases:
Layer 1: Compile-Time Validation
# Workflow declares allowed tools
tools:
safeoutputs___issue:
safeoutputs___file:
allowed_paths: ["docs/**"]
Layer 2: Runtime Isolation
AI Agent Environment:
- Read-only filesystem
- No network access (except MCP)
- Limited memory/CPU
- Sandboxed container
Layer 3: Output Sanitization
// Sanitization pipeline
function sanitize(output: SafeOutput): SanitizedOutput {
// 1. Schema validation
validateSchema(output);
// 2. Content sanitization
sanitizeHTML(output.body);
sanitizeURLs(output.body);
// 3. Secret scanning
detectSecrets(output);
// 4. Path validation
validatePaths(output.files);
// 5. Size limits
enforceSize(output);
return sanitized;
}
Layer 4: Execution Control
Approved outputs only:
- Tool in workflow allowlist? ✅
- Path in allowed_paths? ✅
- Size under limit? ✅
- No secrets detected? ✅
- Sanitization passed? ✅
→ Execute action
→ Log to audit trail
Threats Mitigated:
| Threat | Mitigation | Layer |
|---|---|---|
| Path Traversal | Path validation, allowlist | Layer 3 |
| Secret Leakage | Secret scanning | Layer 3 |
| XSS Injection | HTML sanitization | Layer 3 |
| Code Injection | Pattern blocking | Layer 3 |
| Unauthorized Files | allowed_paths | Layer 1 |
| Excessive Size | Size limits | Layer 3 |
| Binary Uploads | Binary detection | Layer 3 |
| Protected Labels | Label validation | Layer 3 |
| Branch Hijacking | Branch validation | Layer 3 |
on: issues
permissions: read-all
tools:
github:
toolsets: [issues]
safeoutputs___comment: # Comment only
Use Case: Issue triage, read-only analysis
on: issues
permissions: read-all
tools:
github:
toolsets: [issues, repos]
safeoutputs___issue:
safeoutputs___comment:
safeoutputs___label:
safeoutputs___file:
allowed_paths:
- "docs/**/*.md"
Use Case: Documentation updates, issue management
on: pull_request
permissions: read-all
tools:
github:
toolsets: [issues, repos, pull_requests]
bash:
allowed-commands: [npm, git]
safeoutputs___pull_request:
base_branch: main
safeoutputs___comment:
safeoutputs___file:
allowed_paths:
- "src/**/*.ts"
- "tests/**/*.test.ts"
- "docs/**"
max_file_size: 1048576
Use Case: Code generation, automated PRs
# ❌ DON'T: Grant all tools
tools:
safeoutputs___*:
# ✅ DO: Grant only needed tools
tools:
safeoutputs___issue:
safeoutputs___comment:
# ❌ DON'T: Allow all paths
tools:
safeoutputs___file:
allowed_paths: ["**"]
# ✅ DO: Whitelist specific paths
tools:
safeoutputs___file:
allowed_paths:
- "docs/**/*.md"
- "README.md"
# For critical operations, use noop + manual approval
tools:
safeoutputs___noop: # AI provides recommendation
# Human reviews recommendation
# Human manually executes if appropriate
# Always enable audit logging (automatic)
# Review logs regularly:
# - /tmp/gh-aw/audit.log
# - GitHub Actions logs
# Test workflow with noop only
tools:
safeoutputs___noop:
# Review AI outputs
# Enable actual tools gradually
---
on: issues
tools:
github:
toolsets: [issues]
safeoutputs___label:
safeoutputs___comment:
---
Analyze this issue and provide triage:
1. Determine if it's a bug, feature, or question
2. Apply appropriate labels using safeoutputs___label
3. Add helpful comment using safeoutputs___comment
4. Suggest assignee if applicable
---
on: push
tools:
github:
toolsets: [repos]
bash:
allowed-commands: [git]
safeoutputs___file:
allowed_paths: ["docs/**"]
---
Review recent code changes and update documentation:
1. Identify changed files
2. Review related documentation
3. Update docs using safeoutputs___file
4. Ensure examples are current
---
on: pull_request
tools:
github:
toolsets: [pull_requests]
safeoutputs___comment:
---
Review this pull request and provide feedback:
1. Check code quality
2. Identify potential issues
3. Add review comment using safeoutputs___comment
4. Suggest improvements
# ❌ BAD
allowed_paths: ["**"] # Allows all files
# ✅ GOOD
allowed_paths: ["docs/**/*.md"] # Specific patterns
# ❌ BAD: Trying to write files directly
Write to src/config.ts
# ✅ GOOD: Using safe outputs
Use safeoutputs___file to update src/config.ts
# Test with malicious inputs:
# - Path traversal: ../../../etc/passwd
# - XSS: <script>alert('xss')</script>
# - Secrets: API_KEY=abc123def456
# Configure appropriate limits
max_file_size: 1048576 # 1MB for code
max_file_size: 10485760 # 10MB for docs
# Review safe outputs logs
tail -f /tmp/gh-aw/safe-outputs.log
# Filter by tool
grep "safeoutputs___file" /tmp/gh-aw/safe-outputs.log
# Count usage
grep -c "safeoutputs___" /tmp/gh-aw/safe-outputs.log
# Alert on suspicious patterns
alerts:
- pattern: "Path traversal blocked"
severity: high
- pattern: "Secret detected"
severity: critical
- pattern: "XSS blocked"
severity: high
Before any safe output is applied, a dedicated threat detection job runs an AI-powered scan:
Agent Output → Threat Detection Scan → ✓ safe → Write Job → GitHub API
→ ✗ suspicious → BLOCKED (workflow fails)
The scan checks for:
This is automatic — no configuration needed. If detection fails, nothing is written.
| Type | Frontmatter Key | What It Does |
|---|---|---|
| Issue | create-issue | Create/update GitHub issues |
| Pull Request | create-pull-request | Create PRs (including cross-repo) |
| Comment | add-comment | Add comments to issues/PRs |
| Label | add-labels | Add labels to issues/PRs |
| File | create-or-update-file | Modify repository files |
| Dispatch | dispatch-workflow | Trigger other workflows (with workflows whitelist and max count) |
| Noop | (default) | Read-only, no writes |
Additionally, safe-outputs supports a top-level allowed-domains key to whitelist network endpoints the agent may contact (see this repo's news workflows for examples).
---
safe-outputs:
create-issue:
title-prefix: "[bot] " # Required title prefix
labels: [automated, report] # Allowed labels only
max-count: 1 # Max issues per run
close-older-issues: true # Auto-close previous
create-pull-request:
max-count: 1
target-repo: owner/other-repo # Cross-repo support
add-labels:
allowed: [bug, feature, docs] # Whitelist of labels
---
max-count to limit operations per runtitle-prefix for easy identificationallowed lists to restrict labels/pathstarget-repoVersion: 2.0.0
Last Updated: 2026-04-02
Maintained by: Hack23 AB
This gh-aw skill is applied by the 11 agentic news workflows in .github/workflows/news-*.md. Their domain contract (analysis-artifact product, gate, article contract) lives in:
.github/prompts/README.md — module catalogue, import rules, AI-FIRST 2-pass rule.analysis/methodologies/ai-driven-analysis-guide.md + analysis/templates/ — 9 core / 14 Tier-C artifacts.05-analysis-gate.md — the single blocking gate before any article content is written.Upstream gh-aw docs (v0.69.3): abridged · complete · agentic-workflows blog series · source repo · GitHub CLI manual.
Master GitHub Agentic Workflows authoring - markdown syntax, natural language instructions, YAML frontmatter, compilation, and workflow patterns
Comprehensive expertise in GitHub Agentic Workflows (v0.68.1) — AI-powered repository automation with five-layer security, safe outputs, MCP tools, and Continuous AI patterns
Comprehensive guide for MCP (Model Context Protocol) server setup, transport protocols, configuration validation, lifecycle management, tool discovery, and error handling patterns