Is changelog-generator safe to install?

SaferSkills independently audited changelog-generator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

examples/ch24-graduation/changelog-generator/SKILL.md · 1 file

examples/ch24-graduation/changelog-generator/SKILL.md1.5 KB · Markdown

description: "Generate a changelog from git commits using conventional commit format. 从 git 提交记录生成 CHANGELOG。"

Changelog Generator

Generate a structured CHANGELOG.md from git commits between two tags or refs.

Workflow

Determine the range:

If user specifies two refs, use them: git log ref1..ref2
If user specifies one ref, use ref..HEAD
If no ref, use last tag to HEAD: git describe --tags --abbrev=0..HEAD

Run scripts/parse-commits.ts to parse git log into structured data
Classify each commit using rules/conventional-commits.md
Group by category and sort by importance
Generate CHANGELOG.md in the format below

Output Format

# Changelog

## [version] - YYYY-MM-DD

### Breaking Changes
- **module**: description (#PR)

### Features
- **module**: description (#PR)

### Bug Fixes
- **module**: description (#PR)

### Performance
- **module**: description (#PR)

### Other
- **module**: description (#PR)

Rules

Follow classification in rules/conventional-commits.md
Include PR/issue number if present in commit message
Extract scope (module name) from conventional commit prefix: feat(auth): ... → scope is auth
Skip merge commits and CI-only commits
If a commit has BREAKING CHANGE: in body, always list under Breaking Changes

Constraints

Do not modify any source files — only generate/update CHANGELOG.md
Preserve existing CHANGELOG.md content below the new section
If no meaningful commits found, report "No changes to document"

changelog-generator— agent skill

Is changelog-generator safe to install?

Changelog Generator

Workflow

Output Format

Rules

Constraints

Audit the pieces. Scan the whole. Decide.