project-change-log — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited project-change-log (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Automatically maintain a CHANGELOG.md file following the Keep a Changelog standard.
/commit command is executedCHANGELOG.md has grown large (rotate old releases into archives — see Keeping the changelog small)The standard format is CHANGELOG.md in the project root, following Keep a Changelog:
# Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/),
and this project adheres to [Semantic Versioning](https://semver.org/).
## [Unreleased]
### Added
- New feature description
### Changed
- Change description
### Fixed
- Bug fix description
## [1.0.0] - 2026-01-04
### Added
- Initial release features| Category | Description |
|---|---|
| Added | New features |
| Changed | Changes in existing functionality |
| Deprecated | Soon-to-be removed features |
| Removed | Removed features |
| Fixed | Bug fixes |
| Security | Vulnerability fixes |
Check if CHANGELOG.md exists in project root:
Extract from the commit:
| Commit Type | Changelog Category |
|---|---|
feat | Added |
fix | Fixed |
docs | Changed |
style | Changed |
refactor | Changed |
perf | Changed |
test | Changed |
build | Changed |
ci | Changed |
chore | Changed |
security | Security |
deprecate | Deprecated |
remove | Removed |
Add entry under [Unreleased] section in appropriate category:
## [Unreleased]
### Added
- New entry here with descriptionWhen releasing a version:
[Unreleased] content to new version section[Unreleased] sectionpython3 .claude/skills/project-change-log/scripts/rotate_changelog.py --applyA single CHANGELOG.md grows without bound — one real project reached 197 releases / 2,508 lines / 420 KB. To keep it readable, rotate old releases into per-major archive files.
Policy: keep [Unreleased] + the newest 20 versions in CHANGELOG.md; move older versions into changelog/CHANGELOG-<major>.x.md (e.g. changelog/CHANGELOG-1.x.md), linked from an ## Older releases index at the bottom of the main file.
CHANGELOG.md # title + intro + [Unreleased] + newest 20 + index
changelog/
CHANGELOG-1.x.md # archived 1.x releases, newest-first
CHANGELOG-2.x.md # created when a 2.x release is first rotated outUse the helper script — safe by default (dry run unless `--apply`), Python 3 stdlib only, idempotent, and guaranteed not to drop or duplicate any release:
# Preview what would move (no writes):
python3 .claude/skills/project-change-log/scripts/rotate_changelog.py
# Rotate for real:
python3 .claude/skills/project-change-log/scripts/rotate_changelog.py --applyRun it as the last step of a version release (no-op below 20 versions) or any time the file feels large.
First-time adoption on an existing project (e.g. after this skill is added or updated): run the dry run first and confirm the reported version count looks right, then --apply once and commit the new changelog/ directory with the trimmed CHANGELOG.md in a single commit. It's idempotent, so re-running after later skill updates is safe. If the dry run reports 0/too few versions, the file uses a non-standard heading format — normalize headings to ## [x.y.z] - YYYY-MM-DD first. Full steps + troubleshooting: references/archiving.md.
Flags: --keep N (default 20), --dir changelog, --file CHANGELOG.md. Full details, behavior guarantees, and edge cases: see references/archiving.md.
Each entry should be:
**scope**: descriptionExamples:
### Added
- **auth**: OAuth2 login with Google and GitHub
- User profile settings page
- Dark mode toggle
### Fixed
- **api**: Handle null response in user endpoint
- Memory leak in websocket connectionsInitial CHANGELOG.md template:
# Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/),
and this project adheres to [Semantic Versioning](https://semver.org/).
## [Unreleased]
### Added
### Changed
### Fixed
After each commit:
[Unreleased]Commit: feat(auth): add OAuth2 login support
Changelog Entry:
### Added
- **auth**: OAuth2 login supportCommit: fix(api): handle null response in user endpoint
Changelog Entry:
### Fixed
- **api**: Handle null response in user endpointBefore:
## [Unreleased]
### Added
- Feature A
- Feature B
### Fixed
- Bug fix XAfter releasing v1.2.0:
## [Unreleased]
## [1.2.0] - 2026-01-04
### Added
- Feature A
- Feature B
### Fixed
- Bug fix X~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.