create-release-tag
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands to automate Git operations and GitHub CLI interactions. It implements strict input validation using a regular expression (
^[0-9]+\.[0-9]+\.[0-9]+$) to ensure user-provided version strings do not contain malicious payloads or shell injection characters. - [INDIRECT_PROMPT_INJECTION]: The skill processes repository documentation and GitHub API responses to generate release notes.
- Ingestion points: Reads
docs/about-nemo-fabric/release-notes.mdxand output fromgh api ... releases/generate-notes. - Boundary markers: None explicitly defined in the prompt interpolation logic, relying on structured Markdown templates.
- Capability inventory: Perform
git push, create draft GitHub releases, and write local files to the.tmpdirectory. - Sanitization: The agent is instructed to manually verify evidence, curate content, and remove placeholders before finalization, which mitigates the risk of processing untrusted content from the repository.
- [EXTERNAL_DOWNLOADS]: The skill fetches repository metadata and tags from the official NVIDIA/NeMo-Fabric GitHub repository. These operations are performed against trusted vendor resources and are consistent with the skill's primary purpose.
- [DYNAMIC_EXECUTION]: Executes a local script (
.agents/skills/draft-release-notes/scripts/collect_release_evidence.py) and a project-specific task runner (just). These are internal repository tools used for evidence gathering during the release process.
Audit Metadata