devex-release-setup
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill performs local repository inspection using benign Git commands such as
git symbolic-refto identify the default branch andgit ls-remoteto verify the existence and SHA of remote tags. - [EXTERNAL_DOWNLOADS]: The skill interacts with the vendor's official GitHub repository (
SonarSource/release-github-actions) to retrieve commit SHAs for workflow pinning. These network operations are limited to trusted vendor infrastructure. - [SAFE]: The skill demonstrates a strong security posture by instructing the agent to pin third-party actions to specific commit SHAs and by prompting for user confirmation before making any modifications to existing repository files.
Audit Metadata