setup-semantic-release
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs several well-known development tools from the official NPM registry, including
semantic-release,commitlint, andhusky, to facilitate release automation. - [COMMAND_EXECUTION]: The skill executes standard shell commands to initialize git hooks and create configuration files required for the release pipeline.
- [INDIRECT_PROMPT_INJECTION]: The skill processes the project's
package.jsonto identify existing scripts for hook configuration. - Ingestion points: The skill reads the
scriptsfield from the rootpackage.jsonfile in SKILL.md. - Boundary markers: No explicit delimiters are used when reading project metadata.
- Capability inventory: The skill performs file writes to
.husky/pre-commitand executesnpm installandnpxcommands. - Sanitization: No specific sanitization is performed on the script names identified in
package.jsonbefore being placed in hook files.
Audit Metadata