setup-release-please
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill configures a GitHub Actions workflow that utilizes
googleapis/release-please-action@v5. This is an official action from a well-known organization. - [COMMAND_EXECUTION]: The skill utilizes the
gh(GitHub CLI) tool to perform administrative tasks on the repository. - It modifies repository merge settings (squash merge, merge commits, delete branch on merge).
- It modifies repository workflow permissions to grant write access and allow GitHub Actions to approve pull requests.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a CI/CD pipeline that reacts to repository metadata and branch names.
- Ingestion points: The skill instructs the agent to read
package.jsonto determine the release type and usesgit symbolic-refto identify the trunk branch. - Boundary markers: Absent. The skill assumes the repository structure is standard.
- Capability inventory: The configured workflow is granted
contents: writeandpull-requests: writepermissions. The repository settings are modified to allow automated PR approvals. - Sanitization: Not applicable to the static configuration provided by the skill.
Audit Metadata