kmcp-dev-release-semver
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands including
git,npm, andghto perform repository management tasks such as branch creation, version bumping, and pull request generation. These operations are restricted to the local environment and the project's official repository. - [PROMPT_INJECTION]: The skill implements a workflow that analyzes
git logoutput to recommend semantic versioning levels. This represents a potential surface for indirect prompt injection, as malicious commit messages could attempt to influence the agent's logic. - Ingestion points: Output of
git log(SKILL.md, Section 1). - Boundary markers: None present to isolate the commit message content from the agent's instructions.
- Capability inventory: Local file modifications, branch management, git push operations, and PR creation via
ghCLI. - Sanitization: No explicit sanitization or filtering of commit message content is performed before analysis.
Audit Metadata