local-app-github-publishing
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Uses the GitHub CLI (
gh) and Git commands to verify authentication, check repository existence, and perform repository creation and pushing operations. - [COMMAND_EXECUTION]: Employs a Python subprocess script via a shell heredoc to inspect staged file names and sizes, ensuring no files exceeding 20MB are committed without review.
- [COMMAND_EXECUTION]: Provides a Bash script template (
idempotent-git-patch-apply.sh) that uses Git to apply source patches, including integrity checks likegit apply --checkand sentinel-based idempotency. - [SAFE]: Implements a 'Security-First' workflow that explicitly scans for known credential patterns (e.g., OpenAI, Google, GitHub, Hugging Face) and enforces
.gitignorerules to prevent the accidental exposure of environment variables, private keys, and build artifacts. - [SAFE]: Interacts exclusively with the official GitHub API and authenticated user environments, following best practices for metadata normalization and identity management (using GitHub's noreply email addresses).
Audit Metadata