semantic-versioning

Pass

Audited by Gen Agent Trust Hub on Jul 12, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill defines and uses standard shell commands for git operations and version metadata extraction. These commands, including git tag and git commit, are consistent with the skill's purpose of automating software release tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from project files such as package.json and CHANGELOG.md. It implements safety by validating version strings against the SemVer 2.0.0 specification before processing, reducing the risk of malicious input affecting the agent's logic. Capability inventory includes file system writes and git repository updates. Sanitization is achieved via regex validation.
  • [DYNAMIC_EXECUTION]: The skill uses static shell templates with node and python3 to parse version information from structured files. These commands are fixed in scope and do not execute dynamically generated or untrusted code.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 12, 2026, 10:09 AM
Security Audit — agent-trust-hub — semantic-versioning