release-skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release-skills (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Universal release workflow supporting any project type with multi-language changelog.
When this skill prompts the user, follow this tool-selection rule (priority order):
AskUserQuestion, request_user_input, clarify, ask_user, or any equivalent.Concrete AskUserQuestion references below are examples — substitute the local equivalent in other runtimes.
Just run /release-skills - auto-detects your project configuration.
| Project Type | Version File | Auto-Detected |
|---|---|---|
| Node.js | package.json | ✓ |
| Python | pyproject.toml | ✓ |
| Rust | Cargo.toml | ✓ |
| Claude Plugin | marketplace.json | ✓ |
| Generic | VERSION / version.txt | ✓ |
| Flag | Description |
|---|---|
--dry-run | Preview changes without executing |
--major | Force major version bump |
--minor | Force minor version bump |
--patch | Force patch version bump |
--backfill-releases | Create missing GitHub Releases for existing tags from changelog sections |
.releaserc.yml (optional config override)package.json (Node.js)pyproject.toml (Python)Cargo.toml (Rust)marketplace.json or .claude-plugin/marketplace.json (Claude Plugin)VERSION or version.txt (Generic)CHANGELOG*.mdHISTORY*.mdCHANGES*.mdorigin points to GitHubgh is installed and authenticatedgh release list --limit 5 when availableProject Hook Contract:
If .releaserc.yml defines release.hooks, keep the release workflow generic and delegate project-specific packaging/publishing to those hooks.
Supported hooks:
| Hook | Purpose | Expected Responsibility |
|---|---|---|
prepare_artifact | Make one target releasable | Validate the target is self-contained, sync/embed local dependencies, optionally stage extra files |
publish_artifact | Publish one releasable target | Upload the prepared target (or a staged directory if the project uses one), attach version/changelog/tags |
Supported placeholders:
| Placeholder | Meaning |
|---|---|
{project_root} | Absolute path to repository root |
{target} | Absolute path to the module/skill being released |
{artifact_dir} | Absolute path to a temporary staging directory for this target, when the project uses one |
{version} | Version selected by the release workflow |
{dry_run} | true or false |
{release_notes_file} | Absolute path to a UTF-8 file containing release notes/changelog text |
Execution rules:
prepare_artifact exists, run it once per target before publish-related checks that need the final releasable target state.publish_artifact; do not inline multiline changelog text into shell commands.Language Detection Rules:
Changelog files follow the pattern CHANGELOG_{LANG}.md or CHANGELOG.{lang}.md, where {lang} / {LANG} is a language or region code.
| Pattern | Example | Language |
|---|---|---|
| No suffix | CHANGELOG.md | en (default) |
_{LANG} (uppercase) | CHANGELOG_CN.md, CHANGELOG_JP.md | Corresponding language |
.{lang} (lowercase) | CHANGELOG.zh.md, CHANGELOG.ja.md | Corresponding language |
.{lang-region} | CHANGELOG.zh-CN.md | Corresponding region variant |
Common language codes: zh (Chinese), ja (Japanese), ko (Korean), de (German), fr (French), es (Spanish).
Output Example:
Project detected:
Version file: package.json (1.2.3)
Changelogs:
- CHANGELOG.md (en)
- CHANGELOG.zh.md (zh)
- CHANGELOG.ja.md (ja)LAST_TAG=$(git tag --sort=-v:refname | head -1)
git log ${LAST_TAG}..HEAD --oneline
git diff ${LAST_TAG}..HEAD --statCategorize by conventional commit types:
| Type | Description |
|---|---|
| feat | New features |
| fix | Bug fixes |
| docs | Documentation |
| refactor | Code refactoring |
| perf | Performance improvements |
| test | Test changes |
| style | Formatting, styling |
| chore | Maintenance (skip in changelog) |
Breaking Change Detection:
BREAKING CHANGEBREAKING CHANGE:If breaking changes detected, warn user: "Breaking changes detected. Consider major version bump (--major flag)."
Rules (in priority order):
--major/--minor/--patch → Use specifiedfeat: commits present → Minor bump (1.2.x → 1.3.0)Display version change: 1.2.3 → 1.3.0
For each detected changelog file:
git log ${LAST_TAG}..HEAD --merges --pretty=format:"%H %s"gh pr view <number> --json author --jq '.author.login'gh repo view --json owner --jq '.owner.login')(by @username) to the changelog entrySection Title Translations (built-in):
| Type | en | zh | ja | ko | de | fr | es |
|---|---|---|---|---|---|---|---|
| feat | Features | 新功能 | 新機能 | 새로운 기능 | Funktionen | Fonctionnalités | Características |
| fix | Fixes | 修复 | 修正 | 수정 | Fehlerbehebungen | Corrections | Correcciones |
| docs | Documentation | 文档 | ドキュメント | 문서 | Dokumentation | Documentation | Documentación |
| refactor | Refactor | 重构 | リファクタリング | 리팩토링 | Refactoring | Refactorisation | Refactorización |
| perf | Performance | 性能优化 | パフォーマンス | 성능 | Leistung | Performance | Rendimiento |
| breaking | Breaking Changes | 破坏性变更 | 破壊的変更 | 주요 변경사항 | Breaking Changes | Changements majeurs | Cambios importantes |
Changelog Format:
## {VERSION} - {YYYY-MM-DD}
### Features
- Description of new feature
- Description of third-party contribution (by @username)
### Fixes
- Description of fix
### Documentation
- Description of docs changesOnly include sections that have changes. Omit empty sections.
Third-Party Attribution Rules:
(by @username) for contributors who are NOT the repo owner@ prefix(by @username) format, not translated)Multi-language Example:
English (CHANGELOG.md):
## 1.3.0 - 2026-01-22
### Features
- Add user authentication module (by @contributor1)
- Support OAuth2 login
### Fixes
- Fix memory leak in connection poolChinese (CHANGELOG.zh.md):
## 1.3.0 - 2026-01-22
### 新功能
- 新增用户认证模块 (by @contributor1)
- 支持 OAuth2 登录
### 修复
- 修复连接池内存泄漏问题Japanese (CHANGELOG.ja.md):
## 1.3.0 - 2026-01-22
### 新機能
- ユーザー認証モジュールを追加 (by @contributor1)
- OAuth2 ログインをサポート
### 修正
- コネクションプールのメモリリークを修正Analyze commits since last tag and group by affected skill/module:
skills/<skill-name>/* → Group under that skillExample Grouping:
baoyu-cover-image:
- feat: add new style options
- fix: handle transparent backgrounds
→ README updates: options table
baoyu-comic:
- refactor: improve panel layout algorithm
→ No README updates needed
project:
- docs: update CLAUDE.md architecture sectionFor each skill/module group (in order of changes):
README*.md for mentions of this skill/module git add skills/<skill-name>/*
git add README.md README.zh.md # If updated for this skill
git commit -m "<type>(<skill-name>): <meaningful description>"<type>(<scope>): <description><type>: feat, fix, refactor, docs, perf, etc.<scope>: skill name or "project"<description>: Clear, meaningful description of changesExample Commits:
git commit -m "feat(baoyu-cover-image): add watercolor and minimalist styles"
git commit -m "fix(baoyu-comic): improve panel layout for long dialogues"
git commit -m "docs(project): update architecture documentation"Common README Updates Needed:
| Change Type | README Section to Check |
|---|---|
| New options/flags | Options table, usage examples |
| Renamed options | Options table, usage examples |
| New features | Feature description, examples |
| Breaking changes | Migration notes, deprecation warnings |
| Restructured internals | Architecture section (if exposed to users) |
CHANGELOG.md## {VERSION} - {YYYY-MM-DD} section through the next ##1.2.3 and v1.2.3publish_artifactVersion Paths by File Type:
| File | Path |
|---|---|
| package.json | $.version |
| pyproject.toml | project.version |
| Cargo.toml | package.version |
| marketplace.json | $.metadata.version |
| VERSION / version.txt | Direct content |
Before creating the release commit, ask user to confirm:
Use AskUserQuestion with three questions:
1.2.3 → 1.3.0 (Recommended), 1.2.3 → 1.2.4, 1.2.3 → 2.0.0Example Output Before Confirmation:
Commits created:
1. feat(baoyu-cover-image): add watercolor and minimalist styles
2. fix(baoyu-comic): improve panel layout for long dialogues
3. docs(project): update architecture documentation
Changelog preview (en):
## 1.3.0 - 2026-01-22
### Features
- Add watercolor and minimalist styles to cover-image
### Fixes
- Improve panel layout for long dialogues in comic
Release notes source: CHANGELOG.md#1.3.0
Ready to create release commit, annotated tag, and GitHub Release.After user confirmation:
git add <version-file>
git add CHANGELOG*.md git commit -m "chore: release v{VERSION}" git tag -a v{VERSION} -F <release-notes-file>If .releaserc.yml sets tag.sign: true, use git tag -s with the same notes file.
git push origin main
git push origin v{VERSION}Note: Do NOT add Co-Authored-By line. This is a release commit, not a code contribution.
Project artifact publishing and GitHub Releases are separate outputs:
release.hooks.publish_artifact exists, run it once per prepared target{release_notes_file} used for the tag and GitHub Release{dry_run}=true and report what would be published if gh release view v{VERSION} >/dev/null 2>&1; then
gh release edit v{VERSION} --title "v{VERSION}" --notes-file <release-notes-file>
else
gh release create v{VERSION} --title "v{VERSION}" --notes-file <release-notes-file> --verify-tag
fiPost-Release Output:
Release v1.3.0 created.
Commits:
1. feat(baoyu-cover-image): add watercolor and minimalist styles
2. fix(baoyu-comic): improve panel layout for long dialogues
3. docs(project): update architecture documentation
4. chore: release v1.3.0
Tag: v1.3.0
Tag type: annotated
GitHub Release: published # or "skipped/local only"
Status: Pushed to origin # or "Local only - run git push when ready"Use this mode when the user asks to backfill historical releases or passes --backfill-releases.
git tag --sort=v:refname
gh release view <tag>v1.2.3 -> 1.2.3CHANGELOG.md; fall back to the first matching changelog file gh release create <tag> --title "<tag>" --notes-file <release-notes-file> --verify-taggit cat-file -t <tag> (commit means lightweight, tag means annotated).Optional config file in project root to override defaults:
# .releaserc.yml - Optional configuration
# Version file (auto-detected if not specified)
version:
file: package.json
path: $.version # JSONPath for JSON, dotted path for TOML
# Changelog files (auto-detected if not specified)
changelog:
files:
- path: CHANGELOG.md
lang: en
- path: CHANGELOG.zh.md
lang: zh
- path: CHANGELOG.ja.md
lang: ja
# Section mapping (conventional commit type → changelog section)
# Use null to skip a type in changelog
sections:
feat: Features
fix: Fixes
docs: Documentation
refactor: Refactor
perf: Performance
test: Tests
chore: null
# Commit message format
commit:
message: "chore: release v{version}"
# Tag format
tag:
prefix: v # Results in v1.0.0
sign: false
# Additional files to include in release commit
include:
- README.md
- package.jsonWhen --dry-run is specified:
=== DRY RUN MODE ===
Project detected:
Version file: package.json (1.2.3)
Changelogs: CHANGELOG.md (en), CHANGELOG.zh.md (zh)
Last tag: v1.2.3
Proposed version: v1.3.0
Changes grouped by skill/module:
baoyu-cover-image:
- feat: add watercolor style
- feat: add minimalist style
→ Commit: feat(baoyu-cover-image): add watercolor and minimalist styles
→ README updates: options table
baoyu-comic:
- fix: panel layout for long dialogues
→ Commit: fix(baoyu-comic): improve panel layout for long dialogues
→ No README updates
Changelog preview (en):
## 1.3.0 - 2026-01-22
### Features
- Add watercolor and minimalist styles to cover-image
### Fixes
- Improve panel layout for long dialogues in comic
Changelog preview (zh):
## 1.3.0 - 2026-01-22
### 新功能
- 为 cover-image 添加水彩和极简风格
### 修复
- 改进 comic 长对话的面板布局
Commits to create:
1. feat(baoyu-cover-image): add watercolor and minimalist styles
2. fix(baoyu-comic): improve panel layout for long dialogues
3. chore: release v1.3.0
No changes made. Run without --dry-run to execute./release-skills # Auto-detect version bump
/release-skills --dry-run # Preview only
/release-skills --minor # Force minor bump
/release-skills --patch # Force patch bump
/release-skills --major # Force major bump (with confirmation)
/release-skills --backfill-releases # Create missing GitHub Releases for existing tagsTrigger this skill when user requests:
Important: If user says "just push" or "直接 push" with uncommitted changes, STILL follow all steps above first.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.