Is write-changeset safe to install?

SaferSkills independently audited write-changeset (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/write-changeset/SKILL.md · 1 file

skills/write-changeset/SKILL.md2.1 KB · Markdown

name: write-changeset

description: Write or update a change set (changeset) file for a pull request or branch. Use when the user says to write, add, update, or run the change set or changeset for a PR/branch before merge. If the repo has no changeset workflow, install it with setup-release-kit first.

license: MIT

metadata:

version: "0.1.0"

Write Change Set

Use this skill when the user wants the PR or branch to carry a changeset before merge.

First Checks

Read repo instructions such as AGENTS.md, CLAUDE.md, and release docs.
Detect existing workflow files: .changeset/, CHANGELOG.md, package scripts, release scripts, PR template, and tests.
Inspect the branch or PR diff before writing anything.
If the workflow already exists, follow the repo's local commands and file format.

Normal Workflow

Find an existing branch-local .changeset/*.md file. Update it when it belongs to this PR.
If none exists and the PR needs one, create exactly one pending changeset file.
Choose the smallest defensible type: major, minor, or patch.
Choose the changelog category used by the repo, usually Added, Changed, Deprecated, Removed, Fixed, Security, Migration Notes, App Author Notes, Known Issues, or Upgrade Notes.
Write the note in user-facing language describing the final result of the PR.
Run the repo's changeset validation command, such as pnpm changeset:check-pr.

Boundaries

Do not edit CHANGELOG.md.
Do not bump versions.
Do not move files into .changeset/released/.
Do not create tags, pushes, or GitHub Releases.
If the PR does not need a changeset, say that directly and explain the reason.

Missing Workflow

If the repo does not have a changeset workflow, stop and tell the user to install it with the setup-release-kit skill. That skill owns the canonical scripts, CI gate, and release tooling; this skill only writes notes into an installed workflow. Do not scaffold from here.

References

For file format rules, read references/changeset-format.md.
For prompt and output examples, read references/examples.md.

write-changeset— agent skill

Is write-changeset safe to install?

Write Change Set

First Checks

Normal Workflow

Boundaries

Missing Workflow

References

Audit the pieces. Scan the whole. Decide.