jewel-release-helper
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various local build and automation tools including
./gradlew,./bazel.cmd, and./tests.cmd. These are standard tools for the specified repository (intellij-community). - [COMMAND_EXECUTION]: The skill executes several project-specific Kotlin scripts located in the
platform/jewel/scripts/directory, such asmetalava-signatures.main.kts,extract-release-notes.main.kts, andjewel-version-updater.main.kts. These are internal vendor resources used for release automation. - [COMMAND_EXECUTION]: The skill performs Git operations including
git checkout,git cherry-pick,git tag, andgit push. These are necessary for the stated purpose of a release helper and include user confirmation prompts before impactful actions like tagging or pushing. - [PROMPT_INJECTION]: The skill ingests untrusted user input via
AskUserQuestion(e.g., version numbers, branch names, and issue IDs) and interpolates them into shell commands (e.g.,git tag JEWEL-<version>...). While this presents a theoretical command injection surface, the risk is mitigated by the interactive nature of the skill and the context of use by developers within a trusted environment.
Audit Metadata