dtctl-release
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the GitHub CLI (
gh) to perform actions such as triggering workflows, merging pull requests, and managing releases. These operations are core to the skill's primary purpose of managing the software release lifecycle and use standard, secure tooling. - [INDIRECT_PROMPT_INJECTION]: The versioning and release notes are generated from Conventional Commits and Pull Request titles, which are external inputs. The skill's design mitigates this risk by requiring manual workflow dispatch and human review of the generated release PR before any artifacts are published.
- [SAFE]: All external tools and repositories referenced, such as
googleapis/release-please,cosign, andsyft, are official resources from trusted organizations or well-known open-source projects.
Audit Metadata