release-notes
Fail
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: CRITICALCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
gh release edit,git log, and various shell scripts (scripts/test.sh,scripts/check.sh,scripts/post-reactions.sh) to manage the release workflow. These are all standard development tasks scoped to the project's repository. - [EXTERNAL_DOWNLOADS]: The skill references
https://mole.fit/andhttps://mole.fit/downloadas the official landing page and download source for the project's GUI application. Although these were flagged by automated scanners, they are legitimate vendor resources for the 'tw93' author and match the skill's context. The skill also fetches a logo fromhttps://cdn.tw93.fun/, which is another vendor-owned domain. - [SAFE]: The
scripts/post-reactions.shscript uses the official GitHub API (gh api) to post reactions to specific releases. This is a common automation task and does not involve unauthorized data access or persistence mechanisms. - [SAFE]: The frontmatter includes
disable-model-invocation: true, which restricts the agent from performing actions without explicit user interaction, providing a significant safety boundary against autonomous misuse.
Recommendations
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata