release-mashay
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to manage code releases, including
git status,git push --follow-tags,pnpm lint, andpnpm run release. These are standard development tasks but involve modifications to the repository and network communication with GitHub. - [INDIRECT_PROMPT_INJECTION]: The skill processes git commit logs which are a source of untrusted data.
- Ingestion points: The agent reads the output of
git logto verify changes and infer version bumps in SKILL.md. - Boundary markers: There are no explicit instructions to the agent to treat the commit message content as untrusted or to ignore instructions embedded within them.
- Capability inventory: The skill has the authority to modify version files and push commits/tags to the remote origin in SKILL.md.
- Sanitization: The skill does not describe any sanitization or validation of the commit message strings before they are processed by the agent.
Audit Metadata