release-management

Pass

Audited by Gen Agent Trust Hub on Feb 25, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local git and gh (GitHub CLI) commands to perform repository management tasks such as tagging, pushing updates, and creating release entries.
  • [DYNAMIC_EXECUTION]: The skill uses node -e and sed to programmatically update version identifiers in files like package.json and pyproject.toml. It also uses command execution blocks within script metadata to dynamically fetch the current branch, tag, and commit history.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes repository data (git commit messages) to automate changelog creation and suggest version bumps.
  • Ingestion points: Commit history is retrieved using git log in scripts/create-release.md and scripts/version-manager.py.
  • Boundary markers: None; commit messages are directly interpolated into release notes and CLI command arguments.
  • Capability inventory: Local file system modifications and remote repository interaction via GitHub CLI.
  • Sanitization: Employs regex to match conventional commit types (e.g., 'feat', 'fix'), but description content is not specifically sanitized against instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 25, 2026, 03:09 PM