release-publish

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill implements a 'session gate' in AGENTS.md that requires the agent to execute compose-agentsmd (or npx compose-agentsmd) at the start of every session to synchronize rules. It also allows for global installation via npm install -g compose-agentsmd if necessary.
  • [REMOTE_CODE_EXECUTION]: The post-publish verification workflow in SKILL.md requires the agent to run npx <pkg>@latest --version and npm i -g <pkg>@latest to verify that the newly published package resolves correctly in the registry.
  • [COMMAND_EXECUTION]: The skill performs several high-privilege operations including npm publish (utilizing a pre-configured automation token), Git tag creation, and GitHub Release generation. The compose-agentsmd apply-rules command is also instructed to perform GitHub pushes to update rule sources.
  • [EXTERNAL_DOWNLOADS]: The skill configuration in agent-ruleset.json and AGENTS.md fetches remote rule definitions from the github:metyatech/agent-rules repository and downloads vendor tools from the npm registry.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 02:35 AM