release
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill runs local build and signing scripts (
desktop/scripts/release.sh), dependency installers (npm ci), and versioning tools (uv version). These actions are performed locally within the project directory as part of the intended release workflow.\n- [EXTERNAL_DOWNLOADS]: The skill fetches metadata from GitHub (the project's own repository) and PyPI to verify the release status. The JSON payloads are parsed using an inline Python command (python3 -c). This is used for data extraction and does not involve executing remote code.\n- [CREDENTIALS_UNSAFE]: The skill checks for the existence of local code signing identities and a Tauri updater key (~/.tauri/nurb-desktop.key). These sensitive assets are required for the stated purpose of producing signed releases and are used locally on the developer's machine without being transmitted externally.
Audit Metadata