release
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes pull request metadata (titles, labels, authors) from GitHub to generate release notes, creating a potential surface for indirect prompt injection.
- Ingestion points: Data is read from PR_LIST_FILE in Step 3.
- Boundary markers: The skill explicitly instructs the agent to use a 'data-not-instructions' envelope and to paraphrase content instead of following any instructions embedded in the data.
- Capability inventory: The skill utilizes Bash for local file operations, Git management, and GitHub interactions via gh.
- Sanitization: A local redaction script (scripts/larch.sh redact) is used to scrub secrets and file paths from the notes.
- [COMMAND_EXECUTION]: The skill performs extensive repository operations including branch switching, fetching, committing, and pull request management. These commands are localized to the development environment and target the vendor's own repository (character-ai/larch).
- [DYNAMIC_EXECUTION]: The release process involves compiling the local source code using cargo build to generate the release driver. This runtime compilation is a standard and necessary step for verifying the release artifacts.
Audit Metadata