Is changelog-writer safe to install?

SaferSkills independently audited changelog-writer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/changelog-writer/SKILL.md · 1 file

skills/changelog-writer/SKILL.md2.6 KB · Markdown

name: changelog-writer

description: Writes CHANGELOG.md entries in Keep a Changelog format from a list of commits, PRs, or a diff between two versions. Groups changes into Added, Changed, Deprecated, Removed, Fixed, Security. Use this skill when the user asks to "update the changelog", "write release notes", needs entries for a new version bump, or wants to convert git log output into a readable changelog.

Changelog Writer

You produce CHANGELOG.md entries following Keep a Changelog 1.1.0 and SemVer.

Format

## [1.4.0] - 2026-04-19

### Added
- New `--dry-run` flag for the migrate command (#142)

### Changed
- Default timeout increased from 5s to 30s for slow networks

### Deprecated
- `parseConfig()` — use `loadConfig()` instead, will be removed in 2.0

### Removed
- Legacy v0 API endpoints (`/api/v0/*`)

### Fixed
- Race condition when refreshing tokens during concurrent requests (#138)

### Security
- Bumped `lodash` to 4.17.21 to patch CVE-2021-23337

Categories (use only those that apply)

Added — new features
Changed — changes to existing functionality
Deprecated — features still working but to be removed
Removed — features removed in this version
Fixed — bug fixes
Security — vulnerability fixes (always include CVE if known)

Rules

Audience is the user/integrator, not the contributor. "Added a flag" not "Implemented argparse handler in cli.py".
One entry per user-visible change. Squash multiple commits that fixed one bug into one entry.
Skip internal changes — refactors, test additions, CI tweaks — unless they affect users (e.g. perf improvement).
Reference issues/PRs with (#123) at the end of the entry, not as a link in the middle.
Breaking changes: prefix with **BREAKING:** and explain migration in the description.
Date format: YYYY-MM-DD.
Version order: newest at the top.
Unreleased section at the very top for in-flight changes:

   ## [Unreleased]
   ### Added
   - ...

Process

Get the input (commit list, PR titles, or diff).
Filter out non-user-facing changes.
Group by category.
Rewrite each in past tense, present-user-impact phrasing.
Recommend the version bump (major / minor / patch) based on what's in the changelog:

Has Removed or Breaking → major
Has Added → minor
Only Fixed/Security → patch

Output the markdown ready to paste at the top of CHANGELOG.md, plus a one-line version bump recommendation.

changelog-writer— agent skill

Is changelog-writer safe to install?

Changelog Writer

Format

Categories (use only those that apply)

Rules

Process

Audit the pieces. Scan the whole. Decide.