release-changelog-harness
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends integrating various third-party tools for release automation, including Google's release-please, the Changesets CLI, and ecosystem-specific tools like Melos (Dart) and release-plz (Rust).
- [REMOTE_CODE_EXECUTION]: The documentation outlines a standard distribution pattern where a remote installation script is fetched via curl and piped directly into bash for execution.
- [COMMAND_EXECUTION]: The provided install script blueprint includes logic for system architecture detection, automated checksum verification using sha256sum, and the modification of shell profile files (e.g., .bashrc or .zshrc) to persist environment variable changes and update the PATH.
- [COMMAND_EXECUTION]: The skill uses npx to manage and distribute skills, which involves the dynamic execution of Node.js packages from external repositories.
Audit Metadata