oss-release-policy
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill's primary function is to provide guidance and templates for writing release policies (RELEASES.md). It does not contain any malicious code, obfuscation, or unauthorized network operations.
- [INDIRECT_PROMPT_INJECTION]: The skill uses an interview process to gather project information from the user, which is then used to generate documentation and stored in a local state file (devrel-context.md). While this constitutes an attack surface where external input could be persisted, it is handled within the scope of the skill's intended document-generation purpose.
- Ingestion points: User responses to interview questions (SKILL.md).
- Boundary markers: Not explicitly defined in the instruction text.
- Capability inventory: File write operations for RELEASES.md and devrel-context.md (SKILL.md).
- Sanitization: No explicit validation of user-provided project details is mentioned.
Audit Metadata