release-package
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs legitimate media asset management tasks, including reading project references, generating JSON manifests, and calculating SHA256 checksums.
- [COMMAND_EXECUTION]: The workflow involves running a local script "scripts/release_package.py" for asset validation and collection. This is consistent with the skill's primary function of release management.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external project files (e.g., "RELEASE_DELIVERY.md", media registries, QC reports) to construct the release manifest. This data ingestion is a standard part of the release process and does not exhibit malicious patterns.
- Ingestion points: "../../references/RELEASE_DELIVERY.md", media registry, QC reports.
- Boundary markers: Not specified.
- Capability inventory: File system read/write, execution of local script "scripts/release_package.py".
- Sanitization: Not specified.
Audit Metadata