publish-repo

Pass

Audited by Gen Agent Trust Hub on Jul 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of CLI tools to manage and publish the repository, executing commands such as git, make check, and gh (GitHub CLI).
  • [COMMAND_EXECUTION]: Modifies sensitive repository settings, including changing visibility to public using gh repo edit with the --accept-visibility-change-consequences flag and enabling Private Vulnerability Reporting via the GitHub API. The skill instructions contain strong guardrails, requiring the agent to obtain explicit user confirmation before these steps.
  • [EXTERNAL_DOWNLOADS]: Uses npx to execute the skills package from the npm registry, which triggers the download and execution of the package if it is not present.
  • [EXTERNAL_DOWNLOADS]: Invokes the gh skill extension for the GitHub CLI. This operation relies on the presence and execution of a specific CLI extension.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 20, 2026, 10:44 AM
Security Audit — agent-trust-hub — publish-repo