pf-release
Pass
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute standard development commands for Git (branch management, tagging, pushing), pnpm (building, linting, versioning), and the GitHub CLI (release creation). These actions are consistent with the primary purpose of managing a code release lifecycle.
- [EXTERNAL_DOWNLOADS]: Includes commands such as
git pullandpnpm installwhich download code and library dependencies from the configured Git remote and official package registries. - [DATA_EXFILTRATION]: Utilizes
git pushandgh release createto transmit repository updates and release metadata to GitHub. These network operations target a well-known service and are explicitly documented parts of the release flow. - [PROMPT_INJECTION]: The skill reads from local files (
.changeset/*.md) and command outputs (git log) to construct release notes. This represents an indirect prompt injection surface; however, the workflow includes mandatory checkpoints asking for user approval ('푸시해도 될까요?') before critical remote actions are taken.
Audit Metadata