publish
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
git,gh(GitHub CLI),npm, andbunto perform repository operations, trigger CI/CD workflows, and verify package states. It specifically executes a local scriptscript/generate-changelog.tsfor documentation generation. - [EXTERNAL_DOWNLOADS]: Interacts with GitHub and the npm registry to manage release versions and verify the deployment of multiple platform-specific packages.
- [DATA_EXFILTRATION]: Uses the
agent-discordtool to announce releases to a specific Discord channel. This involves accessing Discord authentication context to perform the announcement as part of the automated workflow. - [PROMPT_INJECTION]: Ingests potentially untrusted data from git logs and repository metadata to generate release narratives. While this presents an indirect prompt injection surface, it is a standard part of the automated release process.
Audit Metadata