release-kotlin-library
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Git and publication commands via a bundled Python script. Technical review confirms that all subprocess calls use argument lists rather than shell strings, which effectively eliminates shell injection risks. The script also redacts sensitive environment variables from its logs and child processes where they are not strictly required.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository changelogs and pull request metadata to automate release documentation. This exposure is mitigated by explicit instructions for the agent to use structured formatting and the requirement for a final human-in-the-loop approval gate for the generated content.\n- [SAFE]: The skill incorporates multiple security best practices, including safe environment file parsing, path traversal prevention, and automated testing to ensure that credentials are never leaked in error messages or standard output.
Audit Metadata