release-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes dynamic context placeholders to execute local commands during skill loading to provide the agent with project metadata. These commands are restricted to local git and file metadata and do not perform network operations or access sensitive system files.
- Evidence in
SKILL.md:!git describe --tags --abbrev=0 2>/dev/null || echo "No tags yet" - Evidence in
SKILL.md:!jq -r '.metadata.version' .claude-plugin/marketplace.json - Evidence in
SKILL.md:!git log --oneline $(git describe --tags --abbrev=0 2>/dev/null)..HEAD 2>/dev/null | wc -l | tr -d ' '
Audit Metadata