sglang-cherrypick
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local CLI tools like git and gh to perform automation tasks. Arguments such as target_branch and pr_numbers are validated with strict regular expressions to prevent command injection before being used in shell blocks.
- [EXTERNAL_DOWNLOADS]: The skill fetches metadata and git objects from the official sgl-project/sglang repository on GitHub.
- [SAFE]: No malicious patterns such as credential exfiltration, obfuscation, or unauthorized remote code execution were detected. The skill's behavior aligns with its documented purpose of managing release cherry-picks for the SGLang project.
Audit Metadata