release-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes common command-line utilities such as
git,gh(GitHub CLI),zip, andtar, along with custom Python and Bash scripts to automate the release process. These tools are used for their intended purposes in a development environment. - [EXTERNAL_DOWNLOADS]: The
update-readme.pyscript fetches metadata from the official GitHub API (api.github.com) to synchronize documentation with current release states. GitHub is recognized as a well-known service, and the operation is documented and functional. - [DATA_EXFILTRATION]: The skill accesses the
GITHUB_TOKENfrom the environment for authenticating with GitHub's well-known API services. This is a standard and necessary practice for the skill's documented release automation functionality. - [INDIRECT_PROMPT_INJECTION]: The skill ingests content from repository files like
README.mdandCHANGELOG.mdto generate structured release notes. The scripts use specific parsing logic (regex and table extraction) to process this local, developer-controlled data.
Audit Metadata