release-please-release

Pass

Audited by Gen Agent Trust Hub on Jul 29, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements rigorous 'Hard Gates' that prevent the agent from performing unauthorized actions. It explicitly forbids pushing, tagging, or merging without per-operation confirmation and requires verification that Release Please is the intended release manager for the repository.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the release-please tool and the googleapis/release-please-action GitHub Action. These are industry-standard release management tools maintained by a trusted organization.
  • [INDIRECT_PROMPT_INJECTION]: The skill involves analyzing potentially untrusted content such as commit messages and pull request metadata. It mitigates the risk of malicious instructions in these fields by requiring the agent to perform an 'Impact Audit', comparing commit descriptions against the actual code changes (diffs) to ensure the release classification is accurate and safe. Ingestion points: Commit history and diffs accessed in SKILL.md. Boundary markers: Explicit instructions to 'Compare commit-message classification with actual diffs' and 'verify ownership'. Capability inventory: Recommendation of release commands and merging PRs (if authorized). Sanitization: Manual verification gates and comparison against authoritative code diffs.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 29, 2026, 10:09 AM
Security Audit — agent-trust-hub — release-please-release