release
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interpolates the user-provided argument directly into shell command strings, such as $CLAUDE_PROJECT_DIR/go/bin/evolve release-preflight --dry-run. This creates a command injection surface.
- Ingestion points: The version argument supplied by the user in the skill invocation (SKILL.md).
- Boundary markers: No escaping, shell-safe delimiters, or ignore-embedded-instruction warnings are specified for the interpolation.
- Capability inventory: The skill executes local binaries and standard development tools including git and gh (SKILL.md).
- Sanitization: No input validation or sanitization logic is described to ensure the target string does not contain shell metacharacters.
Audit Metadata