release-bumper
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
execFileSyncwithin itsplan-release.tsscript to interact with the localgitandpnpmcommand-line interfaces. These calls are used for legitimate repository discovery, such as retrieving the repository root, listing tags, and identifying changed files. - [COMMAND_EXECUTION]: The skill instructions direct the AI agent to execute local commands using
bun runanduv runto invoke the provided helper scripts. It also instructs the agent to perform Git operations (commit and tag) to finalize releases. These actions are standard for the skill's stated purpose of release automation. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from repository files such as
package.json,pnpm-workspace.yaml, and Git diff outputs. - Ingestion points: Reads manifest files (
package.json,pnpm-workspace.yaml) and Git metadata (tags, diffs, file lists) viafs.readFileSyncandexecFileSync. - Boundary markers: The helper scripts return structured JSON output for the agent to process, and the
SKILL.mdprovides explicit workflow steps to maintain control over the execution flow. - Capability inventory: The skill has the capability to write to the local file system (changelogs and manifests) and execute local Git commands (commit, tag).
- Sanitization: Version strings and changelog structures are strictly validated using regular expressions (Semver) and structural checks in the Python helper scripts before any writes or Git operations are performed.
Audit Metadata