release-engine
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
bundle exec rspec,gem build, andgem pushto automate the release process of Rails engines. These commands interact with the local filesystem and external gem registries as part of the standard deployment workflow.- [INDIRECT_PROMPT_INJECTION]: The skill ingests content from files such asCHANGELOG.md,version.rb, and*.gemspecto generate release artifacts and verify release readiness. This creates a surface where malicious instructions embedded in these files by other contributors could influence the agent's actions during the release process. - Ingestion points:
CHANGELOG.md,lib/**/version.rb, and*.gemspec. - Boundary markers: None; the instructions do not provide explicit delimiters or warnings to ignore instructions within the ingested content.
- Capability inventory: Shell execution capabilities via
bundle,gem, andtar. - Sanitization: None; the skill does not perform validation or filtering of the text content extracted from the project files.
Audit Metadata