cargo-publish
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The workflow involves executing standard development tools such as
cargo,git,gh, andlaunchctl. It specifically relies on local workspace scripts (scripts/check-publish-ready.shandscripts/preflight-publish.sh) to enforce pre-flight safety gates, including branch checks and identity verification. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to
crates.iousingcurlto verify the propagation of published packages.crates.iois the official and well-known registry for the Rust ecosystem, and these operations are standard for package publishing workflows. - [CREDENTIALS_UNSAFE]: The skill includes an identity check that validates the current GitHub user through
gh auth statusto ensure only the authorized publisher (bobmatnyc) proceeds with the release. No sensitive credentials, tokens, or private keys are hardcoded or exposed.
Audit Metadata