deploy
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a series of bash commands to automate the software release lifecycle. This includes preflight checks using Go tools (
go mod tidy,go test,go vet), git repository state verification (git diff,git status), and release management commands (git tag,git push). - [EXTERNAL_DOWNLOADS]: The skill performs network operations to verify the success of a release. It uses the GitHub CLI (
gh) to view release status and thenpmpackage manager to check published package versions on the npm registry. - [DATA_EXPOSURE]: The troubleshooting documentation includes a bash script designed to extract and decode OIDC identity tokens (
ACTIONS_ID_TOKEN_REQUEST_TOKEN) within a GitHub Actions environment. This is presented as a debugging tool for verifying JWT claims during OIDC authentication issues and does not constitute a malicious exfiltration pattern in this context. - [REMOTE_CODE_EXECUTION]: While the skill involves package management and deployment, it does not download or execute untrusted scripts from the internet. All operations use standard, well-known development tools within the local environment.
Audit Metadata