repo-delivery
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a shell script
scripts/compact-delivery.shto automate Git operations. Analysis shows the script implements proper input validation, specifically checking for unsafe path patterns (e.g.,..,*,?) to prevent directory traversal or command injection via file paths. All commands are executed in a bounded manner and require explicit user authorization for operations like pushing or rebasing. - [SAFE]: The skill implements strong security boundaries, explicitly forbidding the creation of pull requests, tags, or releases without separate authorization. It enforces a "read-back" verification step to confirm remote SHAs match local commits, reducing the risk of silent delivery failures or hijacked pushes.
- [SAFE]: The skill handles sensitive data by explicitly requiring the redaction of tokens, credentials, and private payloads in its delivery reports (
references/delivery-report.md).
Audit Metadata