craft-plugin-release

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill employs standard command-line tools such as git, gh (GitHub CLI), composer, jq, and perl for routine development tasks like tagging, release verification, and changelog parsing.
  • [EXTERNAL_DOWNLOADS]: Fetches package metadata from repo.packagist.org. This is a well-known service used by the PHP community to resolve package versions and does not involve executing remote code.
  • [DATA_EXFILTRATION]: Provides specific instructions on using git filter-repo to securely purge sensitive data (e.g., leaked secrets) from repository history, which is a standard defensive practice.
  • [REMOTE_CODE_EXECUTION]: While it references GitHub Actions like ncipollo/release-action, these are standard components of the Craft CMS release ecosystem and are mentioned in a configuration context rather than as dynamic execution vectors.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 01:55 PM
Security Audit — agent-trust-hub — craft-plugin-release