release-mac-app
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill employs standard macOS utilities such as
codesign,spctl, andstaplerto verify app integrity and notarization. It also executes user-defined build commands (MAC_RELEASE_PACKAGE_CMD) from a local manifest file. - [DATA_EXFILTRATION]: Manages sensitive signing material and 1Password items. The instructions include strong negative constraints to prevent the agent from printing or echoing secret values, ensuring credentials remain secure.
- [SAFE]: The skill ingests manifest data from a repository-owned
.mac-release.envfile (Ingestion point). While it does not specify boundary markers, its capabilities are restricted to legitimate release tasks, and it includes explicit sanitization rules to protect private keys and secrets during the workflow.
Audit Metadata