release-please

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill generates GitHub Action workflows that utilize official actions from trusted organizations to automate release processes.
  • References googleapis/release-please-action@v4 for core versioning and release logic.
  • References standard GitHub-maintained actions (actions/checkout, actions/setup-node, actions/setup-python, actions/setup-java) for environment configuration.
  • References well-known ecosystem tools such as pypa/gh-action-pypi-publish, goreleaser/goreleaser-action, and docker/build-push-action for package distribution.
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes local repository data to assist in configuring automated releases.
  • Ingestion points: Repository manifest files (e.g., package.json, pyproject.toml, Cargo.toml) and git commit history (Conventional Commits) are parsed to determine project types and versions.
  • Boundary markers: The skill utilizes strict JSON/YAML templates and specific interactive questions to scope user input during configuration generation.
  • Capability inventory: The skill assists the agent in creating configuration files (release-please-config.json, .release-please-manifest.json) and GitHub Action workflow files (.github/workflows/release.yml) within the repository.
  • Sanitization: The generated workflows are designed to use GitHub Actions secrets (e.g., ${{ secrets.NPM_TOKEN }}) and OIDC trusted publishers, ensuring sensitive credentials are not exposed in code or logs.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 05:33 PM