claw-release
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents and triggers the execution of system binaries including
git,jq, andgh(GitHub CLI) to perform release tasks such as committing changes, tagging versions, and pushing to remote repositories. - [COMMAND_EXECUTION]: The workflow relies on a local script located at
./scripts/release-skill.sh. While the contents of this script were not provided for analysis, the documentation clearly states its purpose is to automate version bumping and manifest updates. - [SAFE]: The skill follows security best practices by including a
.clawhubignorefile that explicitly excludes sensitive local data such as.envfiles,.gitdirectories, and credentials from being bundled. - [SAFE]: The tool's network activity is limited to pushing code and releases to GitHub, which is an expected and documented behavior for a release management skill.
Audit Metadata