release
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on several local shell scripts (
scripts/release.sh,scripts/nightly.sh,scripts/notarize.sh, etc.) to perform build and deployment tasks. It also executes standard developer tools likecargo,gh,make, andxcrunto facilitate the software release process. - [EXTERNAL_DOWNLOADS]: The one-time setup section instructs the user or agent to install the
apple-codesigntool using the Cargo package manager (cargo install apple-codesign), which downloads source code and builds the binary from the official crates.io registry. - [CREDENTIALS_UNSAFE]: The skill guides the management of sensitive Apple signing and notarization credentials. It describes reading secrets from local paths (e.g.,
~/save/AppleCertificates/asc_api_key.json,notary_password.txt) and storing them in the macOS system keychain using thesecurity add-generic-passwordcommand to allow automated signing during the release flow. - [DATA_EXFILTRATION]: Performs network operations using the GitHub CLI (
gh) to create releases, upload assets, and trigger repository dispatches. These actions are directed to a well-known service (GitHub) and are consistent with the skill's primary function of publishing software updates to the project's official repository.
Audit Metadata