release
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes shell commands via git, npm, and bash to automate the release lifecycle, including branch verification, tagging, and publishing.
- [COMMAND_EXECUTION]: Runs local scripts scripts/bump-versions.mjs and scripts/release.sh to perform version bumping and package publishing logic.
- [EXTERNAL_DOWNLOADS]: Invokes bunx moon, which may download the moon build system from the npm registry if not already present in the environment.
- [INDIRECT_PROMPT_INJECTION]: Interpolates the user-provided string into several shell command templates. * Ingestion points: User input from the argument-hint in SKILL.md. * Boundary markers: None. * Capability inventory: Git operations, npm publishing, and local script execution. * Sanitization: None; assumes the user or agent provides a valid semver string.
Audit Metadata