release
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for executing standard development and deployment commands using
git,npm,pnpm, andgh(GitHub CLI). These include tagging releases, pushing code, and publishing to the npm registry. - [EXTERNAL_DOWNLOADS]: The skill mentions downloading dependencies via
pnpm installand usingnpm execto run a specific version ofpnpmfrom the official npm registry. It also fetches image assets from a well-known CDN (Alipay) for use in release notes. - [DATA_EXFILTRATION]: The skill uses official APIs (GitHub API, npm registry) to fetch release status and verify package publication. All operations are limited to the vendor's own repository context (
tw93/Pake). - [PROMPT_INJECTION]: The skill includes safety rules that explicitly instruct the agent never to auto-commit or auto-push without user request, reducing the risk of autonomous malicious actions.
Audit Metadata