release-automation-builder

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing standard release automation packages from the official NPM registry, such as @changesets/cli and various @semantic-release plugins. It also includes GitHub Action workflow templates that reference official and well-known actions from the actions and docker organizations, which is standard practice for CI/CD pipelines.
  • [CREDENTIALS_UNSAFE]: The workflow templates correctly demonstrate the use of environment variable interpolation with GitHub Secrets (e.g., ${{ secrets.GITHUB_TOKEN }} and ${{ secrets.NPM_TOKEN }}) for managing sensitive authentication tokens. No hardcoded secrets or insecure credential handling patterns were found.
  • [SAFE]: No malicious patterns, obfuscation, unauthorized data access, or privilege escalation attempts were detected. The skill's instructions and code snippets are consistent with its stated purpose of release automation and follow industry conventions for DevOps workflows.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 09:30 AM
Security Audit — agent-trust-hub — release-automation-builder