release-automation-builder
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing standard release automation packages from the official NPM registry, such as
@changesets/cliand various@semantic-releaseplugins. It also includes GitHub Action workflow templates that reference official and well-known actions from theactionsanddockerorganizations, which is standard practice for CI/CD pipelines. - [CREDENTIALS_UNSAFE]: The workflow templates correctly demonstrate the use of environment variable interpolation with GitHub Secrets (e.g.,
${{ secrets.GITHUB_TOKEN }}and${{ secrets.NPM_TOKEN }}) for managing sensitive authentication tokens. No hardcoded secrets or insecure credential handling patterns were found. - [SAFE]: No malicious patterns, obfuscation, unauthorized data access, or privilege escalation attempts were detected. The skill's instructions and code snippets are consistent with its stated purpose of release automation and follow industry conventions for DevOps workflows.
Audit Metadata