goreleaser

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading and installing GoReleaser using official sources.
  • Fetches the installation script from https://goreleaser.com/static/run within various CI configuration examples (CircleCI, Travis CI, Jenkins).
  • References official container images like goreleaser/goreleaser:latest and alpine:3.19.
  • References well-known GitHub Actions such as actions/checkout@v4, goreleaser/goreleaser-action@v6, and crazy-max/ghaction-import-gpg@v6.
  • [REMOTE_CODE_EXECUTION]: Several CI/CD examples demonstrate the pattern of piping a remote script directly into a shell.
  • Example: curl -sL https://goreleaser.com/static/run | bash -s -- release --clean.
  • This is the documented installation method for the official GoReleaser tool.
  • [COMMAND_EXECUTION]: The skill documents the use of GoReleaser's 'hooks' and 'scripts' features, which execute shell commands during the build or packaging process.
  • builds.hooks.pre and post allow execution of commands like go generate or upx.
  • nfpms.scripts allows embedding installation scripts (preinstall, postinstall) into Linux packages.
  • brews.install and aurs.package define build and installation steps for package managers.
  • [DYNAMIC_EXECUTION]: GoReleaser uses a template engine to evaluate dynamic values in configuration files.
  • Supports accessing environment variables via {{ .Env.VAR }}.
  • Includes a readFile function for interpolating file contents into the configuration.
  • These are core features of the GoReleaser tool documented for legitimate release automation purposes.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes changelog generation which ingests git commit history.
  • Ingestion point: Git commit messages are parsed to generate release notes (references/changelog.md).
  • Capability: The generated changelog is typically published to GitHub/GitLab releases.
  • Sanitization: GoReleaser provides regex-based filters to include or exclude specific commit patterns.
  • This represents a standard feature of release tools where untrusted commit data is processed into structured output.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 07:45 AM