init-release-base-relizy-and-bumpp
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill configures and uses command-line tools for version bumping and changelog generation. Key tools include
relizy-runner,bumpp, andchangelogen. These are executed via local npm scripts and GitHub Actions, which is standard behavior for a release orchestration skill. - [EXTERNAL_DOWNLOADS]: The skill installs several well-known developer packages from the npm registry, including
bumpp,changelogen,relizy, and vendor-specific utilities like@ruan-cat/utils. These are standard dependencies for the described functionality. - [INDIRECT_PROMPT_INJECTION]: The release automation workflow processes data from project files such as
CHANGELOG.mdandpackage.jsonto generate release notes. - Ingestion points: Content is read from
CHANGELOG.mdandpackage.jsonduring the release process (templates/release.yaml, templates/bump.config.ts). - Boundary markers: The GitHub Action uses specific
awkpatterns to delimit sections of the changelog based on version headers. - Capability inventory: The skill uses
execSyncfor command chaining andgh release createfor publishing to GitHub. Access is restricted to the repository's own release environment. - Sanitization: The extraction logic in the CI workflow includes character escaping for git tags before they are used in regex patterns to prevent shell or regex injection.
Audit Metadata