extension-publish
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a collection of instructional reference materials and CI/CD templates for Chrome extension developers. It contains no executable code that could compromise the agent's environment.
- [CREDENTIALS_UNSAFE]: The skill identifies the need for sensitive credentials (OAuth Client ID, Client Secret, Refresh Token) for automated publishing. It correctly follows security best practices by instructing users to store these values as CI/CD secrets rather than hardcoding them.
- [EXTERNAL_DOWNLOADS]: The instructions suggest installing
chrome-webstore-upload-clivia npm. This is a standard, well-known utility for managing Chrome Web Store listings and is documented neutrally as a developer dependency. - [COMMAND_EXECUTION]: The skill provides example GitHub Actions workflows and shell scripts for packaging extensions. These use standard utilities like
zipandjqfor versioning and distribution, posing no risk to the host agent.
Audit Metadata