extension-publish

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is a collection of instructional reference materials and CI/CD templates for Chrome extension developers. It contains no executable code that could compromise the agent's environment.
  • [CREDENTIALS_UNSAFE]: The skill identifies the need for sensitive credentials (OAuth Client ID, Client Secret, Refresh Token) for automated publishing. It correctly follows security best practices by instructing users to store these values as CI/CD secrets rather than hardcoding them.
  • [EXTERNAL_DOWNLOADS]: The instructions suggest installing chrome-webstore-upload-cli via npm. This is a standard, well-known utility for managing Chrome Web Store listings and is documented neutrally as a developer dependency.
  • [COMMAND_EXECUTION]: The skill provides example GitHub Actions workflows and shell scripts for packaging extensions. These use standard utilities like zip and jq for versioning and distribution, posing no risk to the host agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 12:33 PM