creating-releases-json
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Node.js and curl to facilitate manifest validation. It executes a bundled, zero-dependency script (
scripts/validate.mjs) to verify the structure and integrity of generated files. - [EXTERNAL_DOWNLOADS]: Network operations are utilized to fetch existing manifest files from user-specified domains and to communicate with the
api.releases.shservice. These actions are standard for confirming that manifests are live and valid. - [REMOTE_CODE_EXECUTION]: Automated scanners flagged a pattern where remote content is piped to Node.js. Analysis reveals that the remote data is passed into a local validation script for parsing purposes and is not executed as source code.
Audit Metadata