release-please-pr-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes official development tools, specifically the GitHub CLI (
gh) andgit, to perform repository management operations including listing, viewing, merging, and closing pull requests, as well as triggering GitHub Action workflows.- [INDIRECT_PROMPT_INJECTION]: The provided automation scripts ingest and process data from the GitHub API (PR numbers and merge statuses) to determine subsequent actions. While this constitutes a data processing surface, the risk is minimized as follows: - Ingestion points: Data is retrieved directly from the GitHub API via
gh pr listandgh pr viewoutput inSKILL.mdautomation examples. - Boundary markers: Not explicitly defined in shell logic, but the workflow relies on structured JSON output from a trusted service.
- Capability inventory: Scripts have the capability to merge and close pull requests via the shell.
- Sanitization: Employs
jqfiltering (via theghcommand's-qflag) to isolate specific numeric IDs and predefined status strings before command execution.
Audit Metadata