release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Cut SemVer release for single-package repo. Local workflow — bumps version in repo's package manifest, commits, inits annotated tag v<x.y.z>. not push.
Single-package repos only. not monorepo orchestration — ≥ 2 manifests at distinct paths → bail with note: "monorepo detected, use a repo-local release procedure".
Grep at repo root in priority order. First hit wins:
1. package.json → .version
2. pyproject.toml → [project].version | [tool.poetry].version
3. Cargo.toml → [package].version
4. .claude-plugin/plugin.json → .version (single-plugin repo)
5. VERSION → raw SemVer textnot found → ask user which file holds version and how to update.
Tag format: v<x.y.z> (e.g. v1.0.0, v2.3.1).
patch or minor or major → bump direction override.x.y.z (literal SemVer) → pin exactly. ! match ^[0-9]+\.[0-9]+\.[0-9]+$. Permits downgrade.retag-baseline → recovery mode. Drops every prior tag matching §3 pattern and retags HEAD at current manifest version. Requires ≥ 1 prior tag (else error: "no prior tag — use baseline mode by omitting arg"). not touches manifest. If manifest version is also wrong, fix it manually first or use x.y.z form instead.git tag --list "v*" --sort=-v:refname | head -n 1<last-tag>..HEAD if tag exists, else full history.git log <range> --pretty=format:"%H%x09%s"^chore(\([^)]+\))?: release v[0-9]+\.[0-9]+\.[0-9]+ — skill's own release commits not count toward bump. Nothing to release.
Range: <last-tag>..HEAD (or "full history" if no prior tag)
Last tag: <last-tag-or-NONE>
Manifest @ version: <manifest-path> @ <current-version>
Commits in range: <total>
Filtered self-release: <n> (matches §5 regex)
Commits remaining: 0
Next steps:
- Add commits, then re-run.
- To force a release with no new commits, pass an explicit `<x.y.z>` arg.
- To recover a wrong prior tag, pass `retag-baseline`.retag-baseline → target = current manifest version. Manifest unchanged. Proceeds to drop prior tags in §11.5.x.y.z → target = x.y.z. Skip auto-detect.patch/minor/major → bump from current. Skip auto-detect.<type>(<scope>)?!: or body containing BREAKING CHANGE → majorfeat(<scope>)?: → minorx.y.z):x.y.z → x.y.(z+1)x.y.z → x.(y+1).0x.y.z → (x+1).0.0featfixrefactor / docs / chore (non-release) / test / perf / build / ci / style<type>(<scope>)?: prefix<type>(<scope>): prefix. Keep scope only if it disambiguates.#refs, paths, identifiers, SHAs verbatim.core:steno skill — fragments, not filler.<plugin-dir>/.claude-plugin/plugin.json @ <x.y.z>).<last-tag>..HEAD or <full history> if baseline.feat:0 fix:0 refactor:1 docs:0 chore:0 breaking:0 uncategorized:0. Cover all types observed in range.0 breaking + 0 feat → patch (default), 1 breaking → major, arg "x.y.z" → pinned, no prior tag & no arg → baseline (no bump), arg "retag-baseline" → recovery (no bump, manifest unchanged).v<x.y.z> (or <plugin>-v<x.y.z> for monorepo orchestrator).git add <manifest-path>.--cleanup=verbatim (keeps any future #-prefix lines from being stripped as git comments): git commit --cleanup=verbatim --message "$(cat <<'EOF'
chore: release v<x.y.z>
EOF
)"11.5 Delete prior tags (retag-baseline mode only):
git tag --delete <tag>--cleanup=verbatim is mandatory (release notes use ## Features / ## Other headers that git's default cleanup would strip as comments): git tag --annotate --cleanup=verbatim v<x.y.z> --message "$(cat <<'EOF'
v<x.y.z>
<release notes>
EOF
)"git show <tag>).git push origin main && git push origin v<x.y.z>. not push automatically.git push origin :refs/tags/<old-tag>. Skip for tags not pushed.## Features
- new release skill (`/gh:release`)
- add `--auto` example for merge queues
## Fixes
- token expiry boundary (`<` → `≤`)
## Other
- rewrite skills in math-glyph encoding
- drop unused gh CLI flag reference blocksPre-publish: rg --pcre2 '[∀∃∴⊥∈∉∧∨≤≥≠≡¬]' <body> on rendered release notes (§8) before §9 confirm render, release commit body (§11) before git commit, tag annotation body (§12) before git tag --annotate; match → bail and rewrite per core:steno register before mutation.
Apply core:steno to release notes. Tag name and version string and identifiers / paths / #refs / SHAs preserved verbatim.
x.y.z, not pre-release suffixes (skill scope = simple).-a / --annotate), not lightweight.git push, not gh release create. User pushes manually.CHANGELOG.md — release notes live in tag annotation.retag-baseline arg drops every prior tag matching pattern and retags HEAD at current manifest version. Requires ≥ 1 prior tag. Manifest unchanged. If manifest is also wrong, fix it manually first or use x.y.z arg (permits downgrade).chore: release v*) excluded from auto-detect scan → empty range exits cleanly.git tag --annotate and git commit calls in this skill ! pass --cleanup=verbatim. git's default commit.cleanup=strip would silently drop #-prefix lines (release-note section headers) from messages.Heading ## Next; 1–5 atomic items (one sentence each, no Reply prefix); positional dispatch (run <int> or run /<plugin>:<cmd> [args]). Tag cut locally → follow-up usually push (git push origin main && git push origin v<x.y.z>) or gh release create to attach binaries or resume next §T row.
Canonical example after tag created (e.g. v1.2.3):
## Next
1. git push origin main && git push origin v1.2.3 — publish commit + tag
2. gh release create v1.2.3 --notes-from-tag — create GitHub Release w/ tag annotation
3. /sdd:build — start the next §T row~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.