marketplace-publish-extension

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFECOMMAND_EXECUTION

Full Analysis

[COMMAND_EXECUTION]: The script scripts/publish.py executes git commands via subprocess.run to handle catalog updates.
Evidence: Functions _is_git_repo and _git_commit_and_push use subprocess.run with hardcoded git arguments and controlled directory paths (-C) to stage, commit, and push marketplace.json changes.
Context: These operations are central to the skill's stated purpose of publishing extensions and are restricted to standard Git workflows.

Audit Metadata

Risk Level

SAFE

Analyzed

Jun 20, 2026, 07:26 PM