release-please
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill generates GitHub Action workflows that utilize official actions from trusted organizations to automate release processes.
- References
googleapis/release-please-action@v4for core versioning and release logic. - References standard GitHub-maintained actions (
actions/checkout,actions/setup-node,actions/setup-python,actions/setup-java) for environment configuration. - References well-known ecosystem tools such as
pypa/gh-action-pypi-publish,goreleaser/goreleaser-action, anddocker/build-push-actionfor package distribution. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes local repository data to assist in configuring automated releases.
- Ingestion points: Repository manifest files (e.g.,
package.json,pyproject.toml,Cargo.toml) and git commit history (Conventional Commits) are parsed to determine project types and versions. - Boundary markers: The skill utilizes strict JSON/YAML templates and specific interactive questions to scope user input during configuration generation.
- Capability inventory: The skill assists the agent in creating configuration files (
release-please-config.json,.release-please-manifest.json) and GitHub Action workflow files (.github/workflows/release.yml) within the repository. - Sanitization: The generated workflows are designed to use GitHub Actions secrets (e.g.,
${{ secrets.NPM_TOKEN }}) and OIDC trusted publishers, ensuring sensitive credentials are not exposed in code or logs.
Audit Metadata