publish-skill
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script scripts/publish_skill.py uses subprocess.run() to execute standard Git commands such as git clone, git commit, and git push to manage the skill repository. These commands are executed with structured arguments as a list and do not use the shell, which prevents command injection vulnerabilities.
- [EXTERNAL_DOWNLOADS]: The skill clones the repository from GitHub to a local cache directory using git clone. The target repository belongs to the author and is consistent with the tool's intended purpose.
Audit Metadata