release
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes common developer tools including
git,gh,uv, andrgto perform repository management tasks. These are used for branch operations, pulling/pushing code, and running quality gate scripts. - [SAFE]: The skill follows security and operational best practices, such as requiring signed tags (
git tag -s), enforcing a clean working tree before operations, and explicitly prompting for user confirmation before pushing to remote repositories. - [SAFE]: External references are limited to the vendor's own repository on GitHub and official package registries like PyPI, which is consistent with the skill's purpose as a release management tool.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the local repository (e.g.,
CHANGELOG.md,pyproject.toml). It mitigates risks associated with processing external data through explicit verification gates, automated hygiene checks (check_repo_hygiene.py), and mandatory documentation reviews.
Audit Metadata