setup-semantic-release

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs several well-known development tools from the official NPM registry, including semantic-release, commitlint, and husky, to facilitate release automation.
  • [COMMAND_EXECUTION]: The skill executes standard shell commands to initialize git hooks and create configuration files required for the release pipeline.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes the project's package.json to identify existing scripts for hook configuration.
  • Ingestion points: The skill reads the scripts field from the root package.json file in SKILL.md.
  • Boundary markers: No explicit delimiters are used when reading project metadata.
  • Capability inventory: The skill performs file writes to .husky/pre-commit and executes npm install and npx commands.
  • Sanitization: No specific sanitization is performed on the script names identified in package.json before being placed in hook files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 04:40 PM