release-please-release
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements rigorous 'Hard Gates' that prevent the agent from performing unauthorized actions. It explicitly forbids pushing, tagging, or merging without per-operation confirmation and requires verification that Release Please is the intended release manager for the repository.
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
release-pleasetool and thegoogleapis/release-please-actionGitHub Action. These are industry-standard release management tools maintained by a trusted organization. - [INDIRECT_PROMPT_INJECTION]: The skill involves analyzing potentially untrusted content such as commit messages and pull request metadata. It mitigates the risk of malicious instructions in these fields by requiring the agent to perform an 'Impact Audit', comparing commit descriptions against the actual code changes (diffs) to ensure the release classification is accurate and safe. Ingestion points: Commit history and diffs accessed in
SKILL.md. Boundary markers: Explicit instructions to 'Compare commit-message classification with actual diffs' and 'verify ownership'. Capability inventory: Recommendation of release commands and merging PRs (if authorized). Sanitization: Manual verification gates and comparison against authoritative code diffs.
Audit Metadata