skills/tw93/kaku/release/Gen Agent Trust Hub

release

Pass

Audited by Gen Agent Trust Hub on Jun 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on several local shell scripts (scripts/release.sh, scripts/nightly.sh, scripts/notarize.sh, etc.) to perform build and deployment tasks. It also executes standard developer tools like cargo, gh, make, and xcrun to facilitate the software release process.
  • [EXTERNAL_DOWNLOADS]: The one-time setup section instructs the user or agent to install the apple-codesign tool using the Cargo package manager (cargo install apple-codesign), which downloads source code and builds the binary from the official crates.io registry.
  • [CREDENTIALS_UNSAFE]: The skill guides the management of sensitive Apple signing and notarization credentials. It describes reading secrets from local paths (e.g., ~/save/AppleCertificates/asc_api_key.json, notary_password.txt) and storing them in the macOS system keychain using the security add-generic-password command to allow automated signing during the release flow.
  • [DATA_EXFILTRATION]: Performs network operations using the GitHub CLI (gh) to create releases, upload assets, and trigger repository dispatches. These actions are directed to a well-known service (GitHub) and are consistent with the skill's primary function of publishing software updates to the project's official repository.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 28, 2026, 05:49 AM
Security Audit — agent-trust-hub — release