release-notes
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
gitandgh(GitHub CLI) commands to retrieve repository metadata and commit history, and to publish release note drafts to GitHub Gists. These operations are essential for the skill's workflow and target the project's official repository. - [REMOTE_CODE_EXECUTION]: The skill uses
uv runto execute a local contributor analysis script and to run Python code snippets extracted from the project's own codebase. This is used to verify the correctness of examples included in the release notes before they are presented to the user. - [EXTERNAL_DOWNLOADS]: The skill performs network operations via the GitHub CLI to interact with the GitHub API and Gists. These operations are directed at well-known services and are consistent with the stated purpose of managing release documentation.
- [PROMPT_INJECTION]: The skill ingests data from Git logs and changelog files, which constitutes an indirect prompt injection surface. The skill mitigates this through ingestion via standard Git commands, the use of structured templates for output generation, and validation of extracted GitHub handles using regular expressions. The final output is a draft intended for manual review by a human release manager.
Audit Metadata