bump-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bump-skill (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
After any edit to one or more skills/<name>/SKILL.md files in this repo, before committing. Handles the full documentation surface so nothing drifts.
This skill is specific to the `agentic-workflow` repository. Before doing anything, confirm you are in that repo (presence of skills/ + CHANGELOG.md + CHANGELOG.es.md). If not, stop and tell the user.
Versioning policy (from CHANGELOG.md):
| Bump | When |
|---|---|
| major | rename, removed/renamed flag, changed contract or output shape — ships with a migration note |
| minor | new backward-compatible capability: new flag, new section, new routing case |
| patch | wording, examples, clarifications, internal tidy — no behavior change |
Run git diff --name-only HEAD and git diff --cached --name-only to find every modified skills/*/SKILL.md. Union both lists (covers staged and unstaged). If the user names specific skills explicitly, use those instead and verify the files exist.
If no modified skill files are found, say so and stop.
Run git diff HEAD skills/<name>/SKILL.md (add --cached if staged). Read the diff carefully:
name: changed, a flag or section was removed, the outputcontract changed fundamentally. Also check docs/workflow/MIGRATION.md to see if a migration note is needed.
expanded capability was added.
If the nature of the change is ambiguous, ask the user before proceeding. One question covering all ambiguous skills at once is fine.
Parse version: from the SKILL.md frontmatter (line matching ^version:). Apply the semver bump: increment the appropriate component, reset lower components to zero.
Examples: 1.2.3 + patch → 1.2.4; 1.2.3 + minor → 1.3.0; 1.2.3 + major → 2.0.0.
version: in the SKILL.md frontmatterReplace only the version: line in the YAML frontmatter. Touch nothing else in the file.
Locate the per-skill table for <name> under ## Per-skill version history. Insert a new row at the top of that skill's table (newest first):
| <new-version> | <YYYY-MM-DD> | <bump-type> | <one-sentence summary> |major, minor, or patch.the name of the bump type. Write it so a reader instantly knows what changed.
If the skill has no table yet (new skill), create one with the standard header:
#### `<name>`
| Version | Date | Type | What changed |
|---|---|---|---|
| <new-version> | <YYYY-MM-DD> | — | First versioned release |Place it in the correct subsection: User-facing if user-invocable: true, Internal (`user-invocable: false`) otherwise.
Also append a brief entry to the Release log section at the bottom of CHANGELOG.md if this is the first bump in a new date (i.e. no entry for today yet). Merge all same-day bumps into one log line.
Find the same skill's table in CHANGELOG.es.md and add the equivalent row in Spanish. The content must match exactly — this is a translation, not a separate record. Follow the same "newest first" order.
If the skill has no table yet in CHANGELOG.es.md, create one following the same structure as the English version, adapted to Spanish (see existing entries for phrasing conventions).
Open README.md and check two sections:
a) Skills table (under ## The skills): find the row for this skill. If the skill's description or primary behavior changed (minor or major bump), rewrite the "What it does" cell to reflect the current state. For patch bumps, no change is needed unless the cell is already inaccurate.
b) Model & effort table (under ## Recommended model & effort): if the skill's model: or effort: frontmatter changed, update that row.
Make no other changes to README.md.
Apply the same checks as step 7 to README.es.md, translating any updated text to Spanish.
If any skill received a major bump due to a rename or removed/renamed flag:
docs/workflow/MIGRATION.md. If it exists, append a migration note.If it does not exist yet, create it with the standard header and the note.
CLAUDE.md under "Skills available in this repo" if the skill'sname or contract description changed there.
grep -r "<old-name>" docs/ skills/ --include="*.md" -l and update any that now point to the wrong contract.
Print a table:
skill old → new bump
─────────────────────────────────────────
execute-phase 1.2.0 → 1.3.0 minor
plan-fix 1.0.1 → 1.0.2 patchThen print the next step:
All documentation updated. Stage and commit: ``git add skills/<name>/SKILL.md CHANGELOG.md CHANGELOG.es.md README.md README.es.md git commit -m "chore(skills): bump <name> to <version> — <one-line reason>"`If this is a major bump with a migration note, also adddocs/workflow/MIGRATION.md`.
still update the SKILL.md version and CHANGELOG entries, but warn that the diff-based bump analysis is unavailable for untracked files — ask the user what changed.
and length; change only what is factually wrong or missing.
execute-phase touches askill file, and before the commit.
CLAUDE.md section "Version every change" is the policy this skillenforces mechanically.
docs/workflow/MIGRATION.md,which init-workspace reads when installing.
version: field is updated.CHANGELOG.md and CHANGELOG.es.md each have a new row for every bumpedskill, newest first.
README.md and README.es.md skills and model tables are accurate.git add + git commit command, readyto run.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.