release
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various system commands to manage the release workflow.
- Runs
node -eto calculate version increments based on the localpackage.jsonfile. - Executes
gitcommands (describe,log,add,commit,tag,push) to manage repository state and history. - Uses
npm testandnpm publishto verify and distribute the software. - [DATA_EXFILTRATION]: The skill is designed to send local project data to external services.
- Pushes source code and tags to a remote Git repository via
git push. - Uploads the package to the public npm registry via
npm publish. - These actions are the primary intended function of the skill and require manual user confirmation at critical steps.
- [PROMPT_INJECTION]: The skill processes untrusted external data that could contain malicious instructions.
- Data from
git log(commit messages) andpackage.jsonare ingested and processed by the agent. - The skill mitigates this risk by requiring the agent to display the drafted CHANGELOG and version bump for user approval before modifying files or proceeding with the release.
Audit Metadata