repo-publish
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local git commands and project-specific test runners (such as npm, pytest, and make) as part of its core publishing workflow. Evidence: SKILL.md and scripts/intelligent_commit.sh invoke these tools based on project configuration.
- [DATA_EXPOSURE]: The skill includes explicit instructions and logic to avoid accidental disclosure of sensitive information, such as warning users to check git status for secrets and specifically avoiding files like .env or private keys.
- [INDIRECT_PROMPT_INJECTION]: The skill processes local file paths but implements measures to prevent path-based command injection.
- Ingestion points: scripts/intelligent_commit.sh reads file paths from the git staging area using 'git diff --cached --name-only'.
- Boundary markers: The script uses the '--' separator in git commands to ensure file paths are not interpreted as command-line arguments.
- Capability inventory: The skill uses git for version control and various standard build tools for quality gates.
- Sanitization: Commit messages are derived from a hardcoded map of prefixes, and temporary file names are sanitized using 'tr'.
Audit Metadata