skills/tw93/pake/release/Gen Agent Trust Hub

release

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for executing standard development and deployment commands using git, npm, pnpm, and gh (GitHub CLI). These include tagging releases, pushing code, and publishing to the npm registry.
  • [EXTERNAL_DOWNLOADS]: The skill mentions downloading dependencies via pnpm install and using npm exec to run a specific version of pnpm from the official npm registry. It also fetches image assets from a well-known CDN (Alipay) for use in release notes.
  • [DATA_EXFILTRATION]: The skill uses official APIs (GitHub API, npm registry) to fetch release status and verify package publication. All operations are limited to the vendor's own repository context (tw93/Pake).
  • [PROMPT_INJECTION]: The skill includes safety rules that explicitly instruct the agent never to auto-commit or auto-push without user request, reducing the risk of autonomous malicious actions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 03:53 PM
Security Audit — agent-trust-hub — release