publish-project-to-github
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill includes a dedicated audit script (
scripts/audit_public_project.sh) that proactively scans for API keys, private keys, and environment files (.env) before publication. The instructions explicitly block publication if credential material is detected, minimizing the risk of accidental exposure. - [COMMAND_EXECUTION]: The skill uses standard developer tools such as
git,gh(GitHub CLI), andpython3 -m http.server. These are scoped to repository management and local verification tasks. The use ofbashfor the audit script is restricted to a local file bundled with the skill. - [EXTERNAL_DOWNLOADS]: No external code or unknown packages are downloaded during execution. The skill relies on locally available tools and standard GitHub APIs.
- [PROMPT_INJECTION]: The instructions contain clear boundary markers and authority checks, requiring explicit user confirmation before creating public repositories, changing visibility, or modifying existing configurations. It avoids dangerous override patterns.
- [DATA_EXFILTRATION]: Data transfer is limited to pushing the user's intended project files to their own GitHub account via authenticated
gitandghsessions. The audit script helps ensure sensitive data is not included in these transfers. - [PERSISTENCE_MECHANISMS]: No persistence mechanisms, such as cron jobs or shell profile modifications, were detected. The skill's operations are task-specific and conclude after verification.
Audit Metadata