cull-release
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands and project-specific scripts to manage the software release lifecycle. This includes running
npm run release:cullwith specific arguments for checking, preparing, and publishing releases. Additionally, theinstall-suite.shscript performs file system operations such as creating directories and symbolic links to set up the skill environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external tools and platforms which could potentially contain malicious instructions. Ingestion points include JSON output from
npmcommands, local state files in.release-state/, and evidence from GitHub workflows or Homebrew taps. The skill instructions mandate parsing exactly one JSON envelope and re-deriving state from external evidence, serving as boundary markers. Associated capabilities include command execution, file system modification, and network interaction. Sanitization is performed through structured JSON parsing and following repository-enforced phase contracts.
Audit Metadata