onnx-opset-bump-checklist
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- Hash-Based Integrity Verification: The skill utilizes command-line tools to download source archives and calculate their cryptographic hashes.
- Evidence:
curl -sL "https://github.com/onnx/onnx/archive/${REF}.zip" | sha1sum - This pattern is used to generate the checksums required for pinning dependencies in configuration files, which ensures the integrity of the software supply chain by verifying downloads haven't been tampered with.
- Standard Development Tooling: The instructions guide the user through the use of standard development utilities such as the GitHub CLI, git, and cmake.
- Evidence:
gh api repos/onnx/onnx/git/ref/heads/rel-X.Y.0 - These commands are used as intended for repository management and do not involve the execution of unknown or untrusted scripts, but rather facilitate manual developer actions.
- External Resource References: The skill references established source code repositories and internal organizational mirrors for artifact storage.
- Evidence:
https://github.com/onnx/onnx/archive/andvcpkg.storage.devpackages.microsoft.io - These references are appropriate for the skill's context, aligning with the author's identity (Microsoft) and the stated goals of maintaining the ONNX Runtime project.
Audit Metadata