skill-release-gate
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to run a bundled Python script (
scripts/evaluate_skill.py) to validate release candidates. The script is restricted to local file system operations and does not invoke external processes or shell commands beyond its primary auditing functions.\n- [DATA_EXFILTRATION]: The auditing script reads file contents from a user-specified target directory to calculate SHA-256 hashes and search for secret patterns using regex. This data access is localized to the agent's environment, with no network requests or external data transmission detected.\n- [SAFE]: The skill adheres to security best practices by implementing preflight checks that reject symlinks and non-regular files, enforcing structural constraints on skill bundles, and scanning for common sensitive data patterns.
Audit Metadata