fluid-release
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill automates the release lifecycle through various shell commands, including Git operations, the GitHub CLI, and the project's build tool (
flub). These actions perform significant repository tasks such as creating branches, bumping versions (npm pkg set), and managing pull requests. These are standard operations for a release management skill and are executed within the scope of the target repository. - Indirect Prompt Injection: The skill implements state-detection logic by querying external repository data, specifically searching for open issues or pull requests labeled as
release-blocking. This ingestion of external data is used to control the skill's execution flow (e.g., halting if a blocker is found) rather than for direct instruction processing, which is a standard pattern for automated readiness checks.
Audit Metadata