publish-repo
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands to manage repository state and configuration. This includes verifying git status, running project-specific checks via
make check, and using the GitHub CLI (gh) to flip repository visibility to public, enable Private Vulnerability Reporting, and configure branch/tag protection rulesets. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto execute theskillspackage directly from the npm registry. It also references agh skillextension (specifically requiring version 2.90 or higher) to perform specification validation and publishing tasks. - [DATA_EXFILTRATION]: The workflow includes a 'seed' install step where
npx skills addis used to install the repository's own skills locally. This process is documented to send telemetry toskills.sh, which is the intended mechanism for listing the repository in the ecosystem's public catalogue.
Audit Metadata