goreleaser
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading and installing GoReleaser using official sources.
- Fetches the installation script from
https://goreleaser.com/static/runwithin various CI configuration examples (CircleCI, Travis CI, Jenkins). - References official container images like
goreleaser/goreleaser:latestandalpine:3.19. - References well-known GitHub Actions such as
actions/checkout@v4,goreleaser/goreleaser-action@v6, andcrazy-max/ghaction-import-gpg@v6. - [REMOTE_CODE_EXECUTION]: Several CI/CD examples demonstrate the pattern of piping a remote script directly into a shell.
- Example:
curl -sL https://goreleaser.com/static/run | bash -s -- release --clean. - This is the documented installation method for the official GoReleaser tool.
- [COMMAND_EXECUTION]: The skill documents the use of GoReleaser's 'hooks' and 'scripts' features, which execute shell commands during the build or packaging process.
builds.hooks.preandpostallow execution of commands likego generateorupx.nfpms.scriptsallows embedding installation scripts (preinstall, postinstall) into Linux packages.brews.installandaurs.packagedefine build and installation steps for package managers.- [DYNAMIC_EXECUTION]: GoReleaser uses a template engine to evaluate dynamic values in configuration files.
- Supports accessing environment variables via
{{ .Env.VAR }}. - Includes a
readFilefunction for interpolating file contents into the configuration. - These are core features of the GoReleaser tool documented for legitimate release automation purposes.
- [INDIRECT_PROMPT_INJECTION]: The skill describes changelog generation which ingests git commit history.
- Ingestion point: Git commit messages are parsed to generate release notes (
references/changelog.md). - Capability: The generated changelog is typically published to GitHub/GitLab releases.
- Sanitization: GoReleaser provides regex-based filters to include or exclude specific commit patterns.
- This represents a standard feature of release tools where untrusted commit data is processed into structured output.
Audit Metadata