cargo-publish

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The workflow involves executing standard development tools such as cargo, git, gh, and launchctl. It specifically relies on local workspace scripts (scripts/check-publish-ready.sh and scripts/preflight-publish.sh) to enforce pre-flight safety gates, including branch checks and identity verification.
  • [EXTERNAL_DOWNLOADS]: The skill performs network requests to crates.io using curl to verify the propagation of published packages. crates.io is the official and well-known registry for the Rust ecosystem, and these operations are standard for package publishing workflows.
  • [CREDENTIALS_UNSAFE]: The skill includes an identity check that validates the current GitHub user through gh auth status to ensure only the authorized publisher (bobmatnyc) proceeds with the release. No sensitive credentials, tokens, or private keys are hardcoded or exposed.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 02:46 PM
Security Audit — agent-trust-hub — cargo-publish