release-asc-cli
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage the release process.
- Evidence: Use of
git fetch,git tag,make test,make build, and./asc versionto validate the repository state and build artifacts. - Evidence: Use of
ASC_BYPASS_KEYCHAIN=1as an environment variable to allow automated testing without interactive keychain prompts. - [INDIRECT_PROMPT_INJECTION]: The skill reads external data that could contain untrusted instructions.
- Ingestion points: Pull request descriptions, git commit logs, and repository documentation (e.g.,
WINGET.md,release.yml). - Boundary markers: The skill does not explicitly define delimiters for untrusted data, but instructions emphasize user review of the generated announcement.
- Capability inventory: Shell execution (make/git) and external API interactions (Typefully).
- Sanitization: Not explicitly mentioned in the instructions.
- [EXTERNAL_DOWNLOADS]: The skill interacts with external services to perform its tasks.
- Evidence: Fetches repository metadata and pushes tags to GitHub.
- Evidence: Creates social media drafts on Typefully, a well-known service for post scheduling, when authorized by the user.
Audit Metadata