version-badge-pattern
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
child_process.execSyncwithin project configuration files (next.config.mjs,vite.config.ts) to retrieve the current git commit SHA and branch name. This is a standard practice for injecting build-time metadata into web applications. - [DYNAMIC_EXECUTION]: During the build process, the configuration executes a local script (
node scripts/parse-changelog.mjs) provided within the skill to parse the project'sCHANGELOG.mdfile. The script uses regular expressions and size limits to safely extract version data for the UI tooltip.
Audit Metadata