publish-skill
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/publish_skill.pyexecutesgitandgh(GitHub CLI) commands via thesubprocessmodule. These commands are used to clone the repository, create branches, commit files, and open pull requests against themqmalagris/agent-skillsrepository. - [EXTERNAL_DOWNLOADS]: The skill clones the repository
https://github.com/mqmalagris/agent-skillsto the local file system (~/.cache/agent-skills-publish) to perform updates and staging. This repository belongs to the skill's author. - [DYNAMIC_EXECUTION]: The skill performs command execution based on user-provided skill names. The script includes input validation using a regular expression (
[a-z0-9]+(-[a-z0-9]+)*) to ensure skill names follow a specific format, mitigating risks associated with shell injection.
Audit Metadata