push-to-registry Eval report.

Task wording matches this skill metadata.

• Evaluate push-to-registry before installing it in an agent workflow
• design-creative
• GitHub automation workflows; Claude Code teams; teams that value GitHub adoption signals

Install handoff is available.

• npx skills add hashicorp/agent-skills --skill push-to-registry

standard package or runtime install path

• npx skills add hashicorp/agent-skills --skill push-to-registry

Good trust signals with a few areas worth checking before rollout.

• Strong shortlist
• 863 GitHub stars
• MPL-2.0

Needs review

• Dependency or permission surface needs review

This skill should not be selected by an agent without explicit human security review.

• Do not auto-install. Inspect the source, dependencies, and permission surface first.
• Metadata combines secrets access with shell or command execution

MPL-2.0

• MPL-2.0

secrets or environment access, shell or command execution

• Shell or command execution: high
• Network access: medium
• Secrets or environment access: high