release-codexbar
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple local shell scripts (e.g.,
Scripts/release.sh,Scripts/sign-and-notarize.sh,Scripts/check-release-assets.sh) to perform release tasks. These scripts are part of the local repository and are used for their intended purpose in the software development lifecycle. - [CREDENTIALS_UNSAFE]: The skill manages sensitive App Store Connect and Sparkle signing keys. It follows secure practices by explicitly instructing the agent never to print key material and to resolve credentials via 1Password references using the
opCLI. It uses temporary environment files containing only 1Password pointers, which are resolved at runtime byop run. - [DYNAMIC_EXECUTION]: An embedded Python script is used to parse the local
appcast.xmlfile to verify release metadata. This is a targeted verification step performed on local data and does not introduce remote code execution risks.
Audit Metadata