hermes-hookdeck-release
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from commit logs and GitHub API results to automate the drafting of release notes and verify build status. Ingestion points: The agent reads data from
git logandgh apicalls in theSKILL.mdfile. Boundary markers: The skill does not provide instructions to the agent to treat commit messages or API payloads as untrusted data or use delimiters. Capability inventory: The agent can execute shell commands (git,gh), write to temporary files, and perform repository actions like creating releases. Sanitization: No sanitization or escaping of the processed commit content is performed before generating the release notes. - [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands using
gitandghto perform release research, check CI status, and create new releases on GitHub. - [EXTERNAL_DOWNLOADS]: The skill uses
pip downloadto fetch the releasedhermes-hookdeckpackage from PyPI for post-release verification, which is a standard procedure for this workflow.
Audit Metadata