seed-snapshot-release
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified. The skill performs legitimate automation of release workflows using standard developer tools.
- [COMMAND_EXECUTION]: The skill uses
gh(GitHub CLI) andgitcommands to interact with the repository and GitHub API. These commands are constrained to specific tasks like viewing PR status, pushing commits, and watching workflow runs. - [INDIRECT_PROMPT_INJECTION]: The skill reads pull request comments to check for release triggers and results. It uses structured parsing (
jq) to filter for specific strings like/snapshot, which limits the risk of the agent misinterpreting external comment data as instructions. - [DYNAMIC_EXECUTION]: The skill assembles shell scripts using parameters derived from the GitHub API and user selections. The data flow is controlled and used for workflow orchestration (e.g., using a PR number or a timestamp for a workflow anchor).
Audit Metadata