publish-project-to-github
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust security posture by requiring a mandatory audit via a dedicated script (
scripts/audit_public_project.sh) before packaging or publishing any code. This script specifically searches for API keys, private keys, environment variables (.env), and personal filesystem paths. - [DATA_EXFILTRATION]: While the skill's purpose is to upload data to a remote server (GitHub), it explicitly requires user authorization for public visibility and uses standard, authenticated tools (
gitand the GitHub CLI). It targets a well-known service (GitHub) and includes instructions to verify state and avoid overwriting existing data without permission. - [COMMAND_EXECUTION]: The skill uses local shell commands for legitimate administrative tasks, such as initializing Git repositories, creating remote repositories via the GitHub CLI, and running a local development server for verification. These commands are constrained to the intended project scope.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local project files. It mitigates injection risks through multiple defensive layers:
- Ingestion points: The project directory and files are inspected during the Resolve and Audit steps.
- Boundary markers: A strict README template is used to structure generated documentation.
- Capability inventory: Capabilities are limited to standard Git/GitHub operations and a local Python-based preview server.
- Sanitization: The audit script acts as a validator, blocking the process if suspicious content or credentials are detected.
Audit Metadata