skills/tituskirch/skills/release/Gen Agent Trust Hub

release

Pass

Audited by Gen Agent Trust Hub on Oct 20, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository history, including commit messages, pull request titles, and changelog contents, to validate releases and generate reports.
  • Ingestion points: The skill reads commit messages (git log), pull request metadata (gh pr list), and file differences (gh pr diff) as described in Step 4 of the workflow.
  • Boundary markers: The skill implements a "gather facts" workflow and explicitly mandates that the "human decides" before any merge actions, providing a human-in-the-loop safeguard.
  • Capability inventory: The skill has the capability to create pull requests (gh pr create) and merge them (gh pr merge) into protected branches.
  • Sanitization: Instructions in the reference documentation specify resolving configuration data into shell variables using specific jq patterns to prevent unsafe interpolation into command flags.
  • [DYNAMIC_EXECUTION]: The skill utilizes a local shell script (templates/resolve-config.sh) to resolve and merge configuration profiles from .tituskirch-skills.json at runtime.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 20, 2026, 06:48 AM