production-release-gating
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The provided templates use standard shell commands (git) and GitHub Action scripts to manage deployments. These are well-scoped to the task of deployment automation and environment gating.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from git tags and commit messages (ingestion points: GitHub Release event and git log). It uses SemVer regex validation as boundary markers and performs ancestry checks (git merge-base) to verify tag validity. These capabilities (git operations and API updates) are used to control production deployments, with sanitization performed via explicit validation steps.
- [REMOTE_CODE_EXECUTION]: The GitHub Action templates utilize official actions from a well-known service organization pinned to specific commit SHAs, which is a recommended security posture to prevent supply-chain attacks.
Audit Metadata