cull-release-publish
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices for release management, including verification of provenance, signatures, and notarization before publication.
- [COMMAND_EXECUTION]: The skill executes a local
npmcommand to retrieve release state. This is a standard development operation and is constrained by strict verification of the resulting JSON envelope. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a JSON envelope generated by the local environment.
- Ingestion points: Step 1 in
SKILL.mdparses JSON output fromnpm run release:cull. - Boundary markers: Not explicitly defined in the input stream, but the skill enforces strict validation of the
preparedstate andexact metadata. - Capability inventory: Git tag creation and pushing, monitoring GitHub release workflows, and Homebrew promotion.
- Sanitization: The skill requires exact inventory matches and valid signatures/provenance before proceeding, minimizing the risk of processing malicious data.
Audit Metadata