release-notes — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release-notes (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate SEO-optimized GitHub release notes for kwin-mcp.
/release-notes <version>Example: /release-notes v1.0.0
CHANGELOG.md and find the entry for the specified versionpyproject.toml to confirm the current version and project metadata gh release list --limit 5
gh release view <previous-version>Before generating release notes, ensure all integrations (.claude-plugin/marketplace.json, integrations/claude-code/.claude-plugin/plugin.json, integrations/opencode/plugin/package.json, and the OpenCode plugin's bundled SKILL.md) reflect the version being released:
python3 scripts/sync_plugin_version.py # write synced state
python3 scripts/sync_plugin_version.py --check # verify (CI also runs this)If new MCP tools were added or renamed in this release, also confirm that integrations/claude-code/skills/kwin-desktop-automation/SKILL.md reflects them — the OpenCode plugin auto-mirrors that file on its next npm run build. The release notes' New Tools table should match what the SKILL.md exposes.
#### Minor+ Release Template
kwin-mcp vX.Y.Z <one-line value proposition with primary keywords>.
## Highlights
- **Feature name**: Description mentioning exact technology (AT-SPI2, libei, EIS, D-Bus, etc.)
- **Feature name**: Description with concrete numbers (e.g. "29 MCP tools")
- ...
## New Tools
| Tool | Description |
|------|-------------|
| `tool_name` | What it does |
| ... | ... |
## Installation
\```bash
# Using uv (recommended)
uv tool install kwin-mcp
# Using pip
pip install kwin-mcp
\```
**Full Changelog**: https://github.com/isac322/kwin-mcp/compare/vPREVIOUS...vCURRENT#### Patch Release Template
kwin-mcp vX.Y.Z <one-line summary of what was fixed/improved>.
## What's Changed
- **Change description**: Detailed explanation mentioning exact technologies and tool names
**Full Changelog**: https://github.com/isac322/kwin-mcp/compare/vPREVIOUS...vCURRENTpointer_click, element_query). Hosts add their own prefix (mcp__kwin-mcp__* for Claude Code, kwin-mcp_* for OpenCode) — never hardcode prefixes in release notescheck_docs_seo.py § TOOL_COUNT_CANONICAL, README.md tool tables, and integrations/claude-code/skills/kwin-desktop-automation/SKILL.md before tagging the releasepython3 scripts/sync_plugin_version.py so the bundled Claude Code and OpenCode plugins stay in syncShow the generated release notes to the user for review before creating the GitHub release. Ask for confirmation before running:
gh release create vX.Y.Z --title "vX.Y.Z" --notes "..."~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.