subtree-publish

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local bash scripts (scripts/subtree-push.sh and scripts/create-release.sh) to automate development workflows. These scripts wrap standard system tools like git, gh (GitHub CLI), jq, and zip to perform subtree operations and create repository releases.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with GitHub APIs through the gh command-line tool for repository creation and release management. It identifies git, gh, and jq as necessary system dependencies that must be pre-installed by the user.
  • [DATA_EXPOSURE]: The scripts/create-release.sh script implements a robust protection mechanism against accidental data exposure. When packaging the skill for release, it explicitly excludes sensitive files and directories, including .env files (which may contain secrets), archive/ folders (which may contain user data), and output/ directories (runtime artifacts).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 07:50 AM