validate-a-release
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads macOS binaries and YAML manifests from the project's official repository on GitHub (different-ai/openwork) using the GitHub CLI (
gh). These resources are used for post-release verification rather than being executed directly in the host environment without checks. - [COMMAND_EXECUTION]: The script executes various system tools to validate artifacts, including
codesignandspctlfor macOS security verification,opensslfor SHA-512 integrity checks, andPlistBuddyfor metadata inspection. - [SAFE]: Secret management is handled via
infisical, which is a recognized practice for securely injecting environment variables during the publication of test evidence. Additionally, the skill utilizes localized testing environments (MySQL on localhost and Daytona dev containers) to isolate validation tasks.
Audit Metadata