ultrafuzz-release-skill
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local commands using the GitHub CLI (gh) and the Node.js package manager (pnpm). These commands are used to fetch repository tags, list commits, verify CI status, and publish releases. These operations are standard for a release automation tool.
- [EXTERNAL_DOWNLOADS]: The skill uses pnpm install --frozen-lockfile to prepare the environment. This downloads project dependencies from the official npm registry, which is a well-known and trusted service.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, specifically pull request titles and descriptions, to generate release notes.
- Ingestion points: Metadata from merged pull requests, including titles, bodies, and file changes (Step 2).
- Boundary markers: Absent; the instructions do not explicitly require the use of delimiters when processing external PR data.
- Capability inventory: The skill has the ability to execute repository scripts (pnpm ci) and create GitHub releases (gh release create).
- Sanitization: Not explicitly mentioned, though the skill requires the agent to review and convert data into a specific editorial format and requires user approval before publishing.
Audit Metadata