cull-release

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands and project-specific scripts to manage the software release lifecycle. This includes running npm run release:cull with specific arguments for checking, preparing, and publishing releases. Additionally, the install-suite.sh script performs file system operations such as creating directories and symbolic links to set up the skill environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external tools and platforms which could potentially contain malicious instructions. Ingestion points include JSON output from npm commands, local state files in .release-state/, and evidence from GitHub workflows or Homebrew taps. The skill instructions mandate parsing exactly one JSON envelope and re-deriving state from external evidence, serving as boundary markers. Associated capabilities include command execution, file system modification, and network interaction. Sanitization is performed through structured JSON parsing and following repository-enforced phase contracts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 12:51 AM
Security Audit — agent-trust-hub — cull-release