release
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a provided bash script (
scripts/release.sh) to automate the release process. - The script uses standard development tools:
npm versionfor versioning,gitfor committing and tagging, andgh(GitHub CLI) for creating releases. - It performs repository modifications including committing to the
mainbranch, pushing tags to origin, and creating remote releases based on local file content (CHANGELOG.md). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the
CHANGELOG.mdfile. - Ingestion points: Reads content from
CHANGELOG.mdto summarize for the user and extract release notes. - Boundary markers: None implemented; the agent is instructed to read the file content directly.
- Capability inventory: Subprocess calls for
git pushandgh release createare present inscripts/release.sh. - Sanitization: The script uses
sedto extract specific sections of the changelog, but there is no specific sanitization of the text before it is passed to thegh releasecommand as notes.
Audit Metadata