release-publish
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill implements a 'session gate' in
AGENTS.mdthat requires the agent to executecompose-agentsmd(ornpx compose-agentsmd) at the start of every session to synchronize rules. It also allows for global installation vianpm install -g compose-agentsmdif necessary. - [REMOTE_CODE_EXECUTION]: The post-publish verification workflow in
SKILL.mdrequires the agent to runnpx <pkg>@latest --versionandnpm i -g <pkg>@latestto verify that the newly published package resolves correctly in the registry. - [COMMAND_EXECUTION]: The skill performs several high-privilege operations including
npm publish(utilizing a pre-configured automation token), Git tag creation, and GitHub Release generation. Thecompose-agentsmd apply-rulescommand is also instructed to perform GitHub pushes to update rule sources. - [EXTERNAL_DOWNLOADS]: The skill configuration in
agent-ruleset.jsonandAGENTS.mdfetches remote rule definitions from thegithub:metyatech/agent-rulesrepository and downloads vendor tools from the npm registry.
Audit Metadata