changelog-automation
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references standard development dependencies from well-known package registries.
- Fetches packages such as
@commitlint/cli,husky, andsemantic-releasefrom the npm registry. - Fetches the
commitizenpackage from the PyPI registry. - Incorporates official GitHub Actions for workflow automation, including
actions/checkoutandactions/setup-node. - [COMMAND_EXECUTION]: Provides standard shell commands for initializing project configurations and running automation scripts.
- Includes commands for installing packages, creating configuration files (e.g.,
commitlint.config.js), and setting up Git hooks via Husky. - Utilizes environment variables for secure token handling within GitHub Actions workflows (e.g.,
GITHUB_TOKEN,NPM_TOKEN), which is a recommended security practice. - [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that processes external strings (commit messages and PR content) to generate documentation.
- Ingestion points: Commit messages, Pull Request titles, and Pull Request descriptions (Method 5, Method 6).
- Boundary markers: None explicitly defined in the provided configuration templates.
- Capability inventory: File system writes (CHANGELOG.md), Git push operations, and GitHub Release creation.
- Sanitization: Relies on the inherent processing logic of the established third-party tools (e.g., semantic-release, git-cliff).
Audit Metadata