release-process — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release-process (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
I know the release process for the Figma-Context-MCP npm package.
Push to main branch triggers .github/workflows/release.yml.
googleapis/release-please-action@v4)release-please-config.json (node release-type, bump-minor-pre-major)package.json and .release-please-manifest.jsonCHANGELOG.mdpnpm type-checkpnpm buildpnpm publish with NPM_CONFIG_PROVENANCE=trueserver.json version with jqmcp-publisher CLIpackage.json — version field (e.g., "0.28.1")server.json — version field (e.g., "0.14.0") — sync'd by release workflow.release-please-manifest.json — {".": "0.28.1"} — updated by release-pleaserelease-please-config.json — release-type: node, changelog-path, bump-minor-pre-majorserver.json — MCP registry manifest (name, description, packages, env vars)Use this when:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.