init-release-base-relizy-and-bumpp
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of several development dependencies, including community-maintained tools (relizy, bumpp, changelogen, changelogithub, pnpm-workspace-yaml) and packages maintained by the skill author (@ruan-cat/utils, @ruan-cat/commitlint-config). These are standard tools for the described release automation task.
- [COMMAND_EXECUTION]: The skill configures numerous shell scripts in the project's package.json to automate the release process. These include commands for bumping versions, generating changelogs, and pushing tags. The @ruan-cat/utils package's relizy-runner tool also modifies the local environment PATH on Windows to ensure compatibility with GNU tools. These operations are within the expected scope of a release management skill.
- [INDIRECT_PROMPT_INJECTION]: The skill's release automation workflow involves parsing the repository's CHANGELOG.md file to extract content for GitHub Releases. While this creates a surface for indirect prompt injection if the changelog contains malicious content (e.g., from external contributors via commit messages), this is a common and accepted pattern for release automation.
- [SAFE]: The resources and external dependencies trace back to either well-known community tools or the vendor's own infrastructure with no signs of typosquatting or malicious intent.
Audit Metadata