release-cicd
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill mandates a human-in-the-loop approval gate for all tagging operations, ensuring that the agent does not push release tags without explicit user verification.\n- [SAFE]: The instructions for Android signing follow security best practices by requiring credentials to be stored in environment variables rather than committed to the repository.\n- [INDIRECT_PROMPT_INJECTION]: The process of generating release notes involves ingesting untrusted data from commit messages and PR content.\n
- Ingestion points: Git commit logs and Pull Request descriptions (SKILL.md).\n
- Boundary markers: No explicit markers or delimiters are defined for the interpolated text.\n
- Capability inventory: The skill allows pushing git tags and creating GitHub releases.\n
- Sanitization: No sanitization of the external text is specified before it is processed for release notes.
Audit Metadata