eliteforge-feature-oriented-release-flow
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates a multi-state Git release process, executing commands for branching, merging, interactive rebasing, and tagging. It also triggers project-specific deployments via
make deploy. These actions are well-defined within the state machine and restricted to the repository context. - [DATA_EXPOSURE_AND_EXFILTRATION]: Network activity is restricted to standard Git operations (
git fetch,git push,git pull) with the configuredoriginremote. No unauthorized data exfiltration or external network calls were found. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates safe handling of untrusted user input (versions, task IDs, task names) by enforcing path segment validation and Git reference formatting.
- Ingestion points: User-provided inputs for
version,developer,taskName, andtaskIdinSKILL.md. - Boundary markers: Explicit instructions in
SKILL.mdto stop if inputs contain path separators ('/'). - Capability inventory: File system writes (JSON state files), standard Git operations, and execution of local build tools (
make). - Sanitization: Validation of filename segments in
scripts/persist_release_flow_state.pyand branch format verification usinggit check-ref-formatinscripts/release_flow_state.sh.
Audit Metadata