jb-gh-release-with-attempts
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use shell commands (
git,gh,npm, etc.) for managing release lifecycles. This includes tagging, committing changes topackage.jsonorCHANGELOG.md, and pushing to remote repositories. These operations are consistent with the skill's purpose of automating software releases. - [PROMPT_INJECTION]: The skill describes a process that ingests data from local repository files (e.g.,
package.json,git log) to drive automation. While this creates a surface for indirect prompt injection if those files contain malicious content, the skill outlines defensive measures such as strictly validating input parameters like version bump types and verifying repository state before proceeding. - Ingestion points: Reads version strings from
package.jsonand commit messages from the repository history. - Boundary markers: Absent in the provided templates for interpolated data.
- Capability inventory: Uses
Bashtools to modify local files and interact with remote GitHub repositories. - Sanitization: Explicitly requires strict validation of the
bumpargument and manual checks of the repository status.
Audit Metadata