changesets
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions utilize
npx @changesets/cliandnpm installfor widely recognized community tools and official GitHub Actions (actions/checkout,actions/setup-node,changesets/action). These are established industry-standard tools for Node.js development and CI/CD workflows. - [COMMAND_EXECUTION]: The skill uses standard development commands for Git operations, package management (npm/pnpm), and versioning logic. These operations are restricted to the intended purpose of release management.
- [CREDENTIALS_UNSAFE]: The documentation correctly identifies the need for environment-based secrets (
NPM_TOKEN,GITHUB_TOKEN) in CI environments. It uses standard platform-native secret management (e.g., GitHub Secrets) rather than hardcoded credentials.
Audit Metadata