subtree-publish
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local bash scripts (
scripts/subtree-push.shandscripts/create-release.sh) to automate development workflows. These scripts wrap standard system tools likegit,gh(GitHub CLI),jq, andzipto perform subtree operations and create repository releases. - [EXTERNAL_DOWNLOADS]: The skill interacts with GitHub APIs through the
ghcommand-line tool for repository creation and release management. It identifiesgit,gh, andjqas necessary system dependencies that must be pre-installed by the user. - [DATA_EXPOSURE]: The
scripts/create-release.shscript implements a robust protection mechanism against accidental data exposure. When packaging the skill for release, it explicitly excludes sensitive files and directories, including.envfiles (which may contain secrets),archive/folders (which may contain user data), andoutput/directories (runtime artifacts).
Audit Metadata