init-release-base-relizy-and-bumpp

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill configures and uses command-line tools for version bumping and changelog generation. Key tools include relizy-runner, bumpp, and changelogen. These are executed via local npm scripts and GitHub Actions, which is standard behavior for a release orchestration skill.
  • [EXTERNAL_DOWNLOADS]: The skill installs several well-known developer packages from the npm registry, including bumpp, changelogen, relizy, and vendor-specific utilities like @ruan-cat/utils. These are standard dependencies for the described functionality.
  • [INDIRECT_PROMPT_INJECTION]: The release automation workflow processes data from project files such as CHANGELOG.md and package.json to generate release notes.
  • Ingestion points: Content is read from CHANGELOG.md and package.json during the release process (templates/release.yaml, templates/bump.config.ts).
  • Boundary markers: The GitHub Action uses specific awk patterns to delimit sections of the changelog based on version headers.
  • Capability inventory: The skill uses execSync for command chaining and gh release create for publishing to GitHub. Access is restricted to the repository's own release environment.
  • Sanitization: The extraction logic in the CI workflow includes character escaping for git tags before they are used in regex patterns to prevent shell or regex injection.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 09:32 AM
Security Audit — agent-trust-hub — init-release-base-relizy-and-bumpp