comet-release
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository files such as commit messages, package manifests, and changelogs which could potentially contain prompt injection attacks.
- Ingestion points:
package.json, lockfiles, Git logs, andmaintainer-contract.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified.
- Capability inventory: The skill performs file reads, directory access (e.g.,
D:\Project\comet-website-docs), and command execution (build, test, git commands). - Sanitization: No sanitization or validation of the processed data is mentioned.
- [COMMAND_EXECUTION]: The skill is designed to execute various development tools as part of the verification process.
- Evidence: Instructions include running
build,package dry-run, test suites, andMintlifycommands to verify release readiness.
Audit Metadata