electron-release
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides patterns for executing shell commands to sign Windows applications via
smctland Linux artifacts viagpg. These are standard requirements for secure desktop software distribution.\n- [DYNAMIC_EXECUTION]: The skill includes templates for Node.js build scripts and GitHub Action workflows that automate the release process. These scripts are executed within the user's build environment or CI/CD pipeline.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from a project's local files, which could theoretically be used to influence the agent's behavior.\n - Ingestion points: Reads project configuration from
package.json,electron-builder.yml, and environment variables.\n - Boundary markers: No explicit boundary markers are used to separate project data from agent instructions.\n
- Capability inventory: The skill uses
Bash,Read,Grep, andGlobtools to carry out build tasks.\n - Sanitization: The skill recommends best practices like
pnpm audit,pnpm run typecheck, andpnpm run lintto verify project integrity.\n- [EXTERNAL_DOWNLOADS]: The provided CI/CD workflow fetches official GitHub Actions for checking out code and setting up the Node.js environment. These resources are from well-known and trusted providers.
Audit Metadata