release-publish
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill makes use of administrative commands including
sudoand WindowsRunAsfor tasks requiring elevated privileges. It also provides specific .NET alternatives for shell commands likeRemove-Itemto ensure functionality across different environments. - [EXTERNAL_DOWNLOADS]: The skill installs several Node.js utilities from the author's own scope (e.g.,
compose-agentsmd,@metyatech/task-tracker,@metyatech/thread-inbox) and fetches updated agent rules from a remote GitHub repository (metyatech/agent-rules). - [REMOTE_CODE_EXECUTION]: The verification workflow uses
npxto fetch and execute the latest version of a package from the registry to confirm it was published correctly. - [DATA_EXFILTRATION]: The instructions note that an automation token is configured for
npm publishoperations within the author's scope, though no secrets are hardcoded in the skill itself.
Audit Metadata