hunk-release
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands and scripts (git, bun, gh, npm) to manage software releases. These actions are intended for the skill's purpose and are guarded by explicit confirmation prompts.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data to generate release documentation.
- Ingestion points: Reads commit messages, PR summaries, and contributor metadata through git and bun scripts to populate changelogs and release notes.
- Boundary markers: Relies on mandatory manual review of generated text before publication; no programmatic delimiters for ingested text are specified.
- Capability inventory: Includes file system writes, network requests, package publication, and repository updates.
- Sanitization: Human oversight is the primary control for verifying the safety of generated release content.
- [EXTERNAL_DOWNLOADS]: Fetches project dependencies via bun install from official package registries, which is standard behavior for the release workflow.
Audit Metadata