tag-76c7f8 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tag-76c7f8 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Creates a SemVer annotated tag on main by reading conventional commits since the last tag, inferring the correct bump (major / minor / patch), showing a full proposal for approval, then tagging, pushing, and optionally opening a GitHub Release. Never tags silently — the user always approves the version first.
| Flag | Effect |
|---|---|
--major | Force a major bump regardless of commit types |
--minor | Force a minor bump regardless of commit types |
--patch | Force a patch bump regardless of commit types |
--pre <suffix> | Append a pre-release suffix (e.g. --pre rc.1 → v1.3.0-rc.1) |
--release | Create a GitHub Release after pushing without prompting |
--no-release | Skip GitHub Release creation entirely without prompting |
--draft | Create the GitHub Release as a draft (implies --release) |
--no-push | Create the tag locally only; do not push to the remote |
If the user provides a bare version string in the invocation (e.g. /tag v2.0.0), use it verbatim and skip bump inference entirely.
Extract all flags above from the invocation text. If a string matching v?\d+\.\d+\.\d+ (with an optional pre-release suffix) is present, treat it as an explicit version override and jump to step 6 after confirming it does not already exist.
git fetch --tags origin — pull latest tags and remote refs before any inference.git status --short — working tree must be clean.git rev-parse main vs git rev-parse origin/main — check local main is up-to-date.gh run list --branch main --status completed --limit 1 --json conclusion,workflowName,url— check the latest completed CI run on main. If gh is available and authenticated, verify the conclusion is success.
If the working tree is dirty: stop and tell the user to commit or stash first. If local main is behind origin/main: offer to run git pull --ff-only origin main and continue; stop if they decline. If the latest CI run on main is not success: warn clearly — show the workflow name and URL — and require explicit confirmation to proceed ("CI is failing on main. Tag anyway? This may release broken code."). If gh is absent or unauthenticated, skip the CI check and note it was skipped.
Run git describe --tags --match 'v[0-9]*' --abbrev=0 main 2>/dev/null.
LAST_TAG; parse its M.N.P triple.LAST_TAG to empty and base version to 0.0.0.Run git log ${LAST_TAG:+$LAST_TAG..}main --oneline --no-merges. If no commits exist since the last tag: inform the user ("nothing new since <LAST_TAG>") and stop.
Apply the first matching rule in priority order:
| Condition | Bump |
|---|---|
Any commit subject ends with ! OR any commit body contains BREAKING CHANGE: | major |
Any commit type is feat | minor |
Any other conventional-commit type (fix, perf, refactor, docs, test, build, ci, chore) | patch |
| No conventional-commit pattern detected | patch (conservative default; note this to the user) |
If --major, --minor, or --patch was given, use it unconditionally.
Compute the new version by incrementing the chosen component and zeroing lower ones:
(M+1).0.0M.(N+1).0M.N.(P+1)Append the pre-release suffix if --pre <suffix> was given: vM.N.P-<suffix>.
Present a summary block before doing anything:
Proposed tag : v<new_version>
Bump reason : <major feat! | minor feat | patch fix | … | explicit>
Last tag : <LAST_TAG or "none (first release)">
Commits : <N> commit(s) since last tag
Push : origin [or "local only" if --no-push]
GitHub Release: <yes (draft) | yes | no | will ask>
Commits included:
- <subject line>
- <subject line>
… (show up to 20; "and N more…" if longer)Ask the user to approve, adjust the version manually, or cancel. Do not proceed until explicitly approved.
Build a tag message:
Release v<new_version>
<bullet list: "- <subject>" for each commit since last tag>Run against the main ref explicitly (not HEAD, so this works from any branch):
git tag -a "v<new_version>" main -m "<message>"If the tag already exists locally: stop immediately; never overwrite an existing tag.
--no-push)git push origin "v<new_version>"Confirm the push succeeded before continuing. If it fails, surface the error verbatim and stop — do not attempt --force.
--no-release)If --release or --draft was given, create without prompting. Otherwise ask: "Create a GitHub Release for v<new_version>? (y/n)"
If creating:
gh release create "v<new_version>" \
--title "v<new_version>" \
--notes "<same bullet list as step 7>" \
[--draft if --draft was passed]If gh is not installed or not authenticated: skip gracefully, print a note, and suggest gh auth login.
git rev-list -n1 "v<new_version>").git status must be clean.v<new_version> already exists locally orremotely, stop and say so. Use --pre <suffix> for iteration.
is not green. A tag pointing to broken code is worse than a delayed release.
main as the ref, not HEAD.--force on a pushed tag.unpushed tag is broken.
v1.3.0-rc.1) must not be used as the bump baseline for thenext stable release; note this to the user if relevant.
clearly tell the user the inference was a conservative default.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.