changelog-maintenance — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited changelog-maintenance (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
How should the changelog be updated to reflect observed changes in the project’s existing format without inventing unsupported release information?
Use this skill when the user asks to:
CHANGELOG.md entries,Unreleased section,Unreleased to a version section,Do not use this skill to draft polished release announcements, decide or edit versions, create tags, publish releases, push files, or create commits.
Route to:
release-notes for user-facing release-note prose.version-bump for version decisions or version file edits.tag-release for Git tag creation.publish-release skill or manual workflow for publication.atomic-commits or conventional-commits for commit workflows.Inspect or establish:
You MAY:
You MUST:
You MUST NOT:
| State | Evidence | Risk | Default Action | Confirmation | Verification |
|---|---|---|---|---|---|
| Existing format clear | changelog file | R2 | Update in same style if requested | no | diff inspection |
| No changelog exists | file absence | R1/R2 | Propose format; create only if requested | yes for creation | file exists/diff |
| Missing range evidence | no commits/range | R1 | Produce limited draft and state evidence gap | no | limitation note |
| Duplicate entry risk | existing section | R2 | Deduplicate conservatively | no | section review |
| Breaking change evidenced | commits/API/migration | R2 | Add visible breaking/migration note | no | evidence trace |
| Version promotion | version/date evidence | R2/R3 | Promote section only with evidence | ask if missing | heading and date |
| Rewrite old release/global format | user request | R3 | Explain risk and require confirmation | yes | diff review |
| Tag/publish/version change requested | out of scope | Out of scope | Route to owning skill | yes for routed action | not applicable |
Unreleased semantics if the project already uses them.version-bump.tag-release.Allowed:
Requires explicit confirmation:
Forbidden in this skill:
Minimum verification:
Verify:
Final response should include:
## Result
- Changelog entries drafted or changed.
## Evidence
- Changelog format, range, commits, PRs/issues, version/date used.
## Verification
- Diff/section review and unsupported-claim check.
## Limitations
- Missing range, missing date, or out-of-scope release actions.Stop when changelog format, release range, version/date evidence, or requested rewrite scope is ambiguous in a way that could misrepresent the release.
Requires confirmation for:
Route tag, publish, push, version edits, and commit execution to owning skills.
Load:
references/formats.md when changelog style is unclear.references/category-mapping.md when category selection is ambiguous.references/examples.md when the user asks for examples.references/failure-modes.md for duplicate or unsupported-claim risks.references/verification.md for changelog diff checks.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.