Is changelog safe to install?

SaferSkills independently audited changelog (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/changelog/SKILL.md · 1 file

skills/changelog/SKILL.md1.5 KB · Markdown

name: changelog

description: AI DevKit · Update CHANGELOG.md Unreleased items from git commits since the latest release. Use when users ask to update changelog/release notes from recent commits, with one concise line per commit and commit/PR links.

Changelog

Update the top Unreleased list in CHANGELOG.md from commits after the latest release.

Workflow

Find the latest release base:

Prefer the latest reachable tag: git describe --tags --abbrev=0.
If there are no tags, search recent history for a release commit and use that hash.

Get commits: git log <base>..HEAD --reverse --format='%H%x09%s'.
Derive the GitHub repo URL from git remote get-url origin.
For each commit, add one concise changelog line:

Format: - [<short-hash>](<url>) <one-line summary>
If the commit clearly relates to a PR, link the hash to the PR URL instead of the commit URL.
Detect PRs from subjects like (#123), merge commits, or gh pr list --search <hash> --state all --json number,url.

Insert the new lines into the top Unreleased section/list in CHANGELOG.md.

If no Unreleased section exists, create one at the top.
Do not create a dated release heading unless the user asks for a release.

Rules

Keep one line per commit.
Preserve the existing changelog style when obvious.
Always add entries to the top Unreleased list.
Skip noisy commits only when clearly non-user-facing and explain what was skipped.
Do not invent PR links; use commit links when PR evidence is missing.

changelog— agent skill

Is changelog safe to install?

Changelog

Workflow

Rules

Audit the pieces. Scan the whole. Decide.