setup-release-please

Pass

Audited by Gen Agent Trust Hub on Aug 31, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill configures a GitHub Actions workflow that utilizes googleapis/release-please-action@v5. This is an official action from a well-known organization.
  • [COMMAND_EXECUTION]: The skill utilizes the gh (GitHub CLI) tool to perform administrative tasks on the repository.
  • It modifies repository merge settings (squash merge, merge commits, delete branch on merge).
  • It modifies repository workflow permissions to grant write access and allow GitHub Actions to approve pull requests.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes a CI/CD pipeline that reacts to repository metadata and branch names.
  • Ingestion points: The skill instructs the agent to read package.json to determine the release type and uses git symbolic-ref to identify the trunk branch.
  • Boundary markers: Absent. The skill assumes the repository structure is standard.
  • Capability inventory: The configured workflow is granted contents: write and pull-requests: write permissions. The repository settings are modified to allow automated PR approvals.
  • Sanitization: Not applicable to the static configuration provided by the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 31, 2026, 11:06 PM
Security Audit — agent-trust-hub — setup-release-please