release
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
!syntax for dynamic context injection inSKILL.mdto retrieve the current Git branch and working tree status. These are standard read-only commands (git rev-parse,git status) used to provide environmental context to the agent. - [COMMAND_EXECUTION]: The skill defines a sequence of shell commands for the release process, including
npm whoami,git tag,pnpm install, andpnpm publish. These are legitimate operations for the skill's stated purpose of managing package releases. - [SAFE]: Data exfiltration is not present. While the skill reads project information and executes network commands (
npm publish,git push), these are directed at official infrastructure (npm registry, project's Git origin) and are intrinsic to the primary function of shipping code. - [SAFE]: Package dependencies and build steps (
pnpm install,pnpm build) are restricted to the local workspace and official registries. No untrusted third-party scripts or remote payloads are executed.
Audit Metadata