craft-plugin-release
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill employs standard command-line tools such as
git,gh(GitHub CLI),composer,jq, andperlfor routine development tasks like tagging, release verification, and changelog parsing. - [EXTERNAL_DOWNLOADS]: Fetches package metadata from
repo.packagist.org. This is a well-known service used by the PHP community to resolve package versions and does not involve executing remote code. - [DATA_EXFILTRATION]: Provides specific instructions on using
git filter-repoto securely purge sensitive data (e.g., leaked secrets) from repository history, which is a standard defensive practice. - [REMOTE_CODE_EXECUTION]: While it references GitHub Actions like
ncipollo/release-action, these are standard components of the Craft CMS release ecosystem and are mentioned in a configuration context rather than as dynamic execution vectors.
Audit Metadata