release-watch
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using a variety of local tools including
subscription-research,digestpilot-runtime, and Node.js scripts located within the repository (scripts/doctor.mjs,scripts/bootstrap-runtime.mjs). These commands are used to diagnose the environment and perform the core release monitoring tasks. - [PROMPT_INJECTION]: The skill is designed to ingest and process GitHub release data, specifically the
bodyfield which contains untrusted third-party release notes. This creates a surface for indirect prompt injection. - Ingestion points: The agent reads release notes (
bodyfield) either directly from the GitHub API or from a user-providedgithub-releases.jsonfile. - Boundary markers: The instructions do not define clear delimiters or provide the agent with guidance to ignore potentially malicious instructions embedded within the release notes.
- Capability inventory: The agent has the ability to execute shell commands and interact with the local filesystem (reading and writing JSON configuration and state files).
- Sanitization: There is no evidence of sanitization or filtering applied to the external release content before it is processed by the agent.
Audit Metadata