verify-release
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches source code tarballs from the official GitHub API to verify project metadata and extension configurations.
- [EXTERNAL_DOWNLOADS]: Uses the npm package manager to download and execute the specific version of the software being verified to ensure it is correctly published.
- [COMMAND_EXECUTION]: Runs a variety of command-line tools including
gh,npm, andpnpmto inspect release artifacts, workflow statuses, and package integrity. - [COMMAND_EXECUTION]: Executes the project's own CLI tools to perform smoke tests, including starting a local service and running an agent turn in an isolated temporary home directory.
- [DATA_EXPOSURE]: Uses an inherited
OPENAI_API_KEYfor live testing purposes, accompanied by explicit instructions to never print or reveal the secret in outputs.
Audit Metadata