commit-push-sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited commit-push-sync (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run when the user asks to commit and push (not for commit-only requests). The goal is to do the normal git work — writing each commit in changelog-ready Conventional Commits style — keep the project's docs (CLAUDE.md + README) in sync with what you just changed, optionally attach a tag when (and only when) the user asks for one, and — only when the repo lives on GitHub — keep its public metadata (description + topics) in sync too, plus cut a GitHub Release when the push carried a tag.
Local docs live in the repo and have nothing to do with GitHub, so this step always applies — including for repos hosted on GitLab, Bitbucket, a private server, or no remote at all.
Look at the changes being committed and check whether they make the project's docs stale:
AGENTS.md if present) — do the changes affect guidance an AI assistant relies on (structure, conventions, workflows)? Keep it accurate.If a doc edit is warranted, make it and stage it alongside the code so it lands in the same commit. If the docs are already accurate, change nothing. Don't invent docs that don't already exist — only update files the repo already has.
Borrowed from changelogen's philosophy: the commit history is the source of truth, so every everyday commit should be written well enough that a changelog or release could later be generated from git history alone, with zero manual curation. You are not generating a changelog here — you are just making sure the commit messages are clean enough that any tool could.
Stage the intended changes (plus any doc updates from step 1) and write the message in Conventional Commits form:
type(scope): subjectfeat, fix, docs, refactor, perf, test, build, ci, chore (and style).feat(auth): ….! after the type/scope (feat!:) and/or add a BREAKING CHANGE: footer explaining the break.Stay release-aware (informational only — do NOT act): after composing the message, note in one line the semver impact the type implies, so the user knows where the history is heading. Do not bump the version, write a CHANGELOG.md, or create a tag — those stay out of the everyday flow.
| Commit | Implied bump | On 0.x (drops a level) |
|---|---|---|
BREAKING CHANGE / type!: | major | minor |
feat: | minor | patch |
fix: and others | patch | patch |
Then push.
Tagging is off by default — a routine commit+push never creates a tag. Only attach one when the user explicitly asks for it (e.g. "commit and push with a tag", "tag this push").
Tag format is always `v<version>` (e.g. v1.4.0) — a leading v followed by the version number, no exceptions.
Figuring out the version is the LLM's call — use standard [semver](https://semver.org/). Look at what changed since the last tag (git describe --tags --abbrev=0 for the current version, then the commits/diff in range) and propose the next version yourself:
| Change since last tag | Bump |
|---|---|
Backward-incompatible change — breaking change or a removed feature (type!: / BREAKING CHANGE:) | major |
Backward-compatible new feature (feat:) | minor |
Backward-compatible fix or internal change (fix: and others) | patch |
Pick the bump from the highest-impact change in range. (Optional 0.x convention, matching changelog-release: while on 0.y.z you may drop one level — a breaking change bumps minor, a feature bumps patch.) Pre-releases (-rc.1, -beta) are fine when the user wants one; use your judgment for mixed or ambiguous cases.
Because a tag (and the Release below) is outward-facing, propose the computed `v<version>` and confirm it with the user before creating anything — let them override. Then create an annotated tag on the commit you just made and push it with the branch:
git tag -a v1.4.0 -m "v1.4.0"
git push --follow-tags # pushes the branch and any annotated tags it reachesRemember that a tag was pushed in this run — it's the trigger for the GitHub Release step below.
gh?Everything below — both the Release (when this push carried a tag) and the metadata sync — is GitHub-only. Many projects are not on GitHub — in that case there is simply nothing to do here: report the push result (and the tag, if you pushed one) and stop. This is the normal, expected outcome, not a failure. The tag still lives on the remote either way; only the GitHub Release is skipped.
After the push succeeds, check all of:
git remote -v # is there a GitHub remote at all?
gh --version # is gh installed?
gh auth status # is it authenticated?If the remote is not GitHub, or gh is missing/unauthenticated, stop here and just report the push (and any doc updates, and any tag you pushed). Do not install or authenticate gh yourself, and don't treat the absence of GitHub as something to apologize for or work around.
Run this step only when both are true: the push attached a tag (from the opt-in step above) and the repo is GitHub with a usable gh. A push without a tag never creates a release — skip straight to step 5.
A Release is outward-facing, so confirm before publishing. Draft notes from the commits this tag introduces, then create the release on the existing tag:
# Default: let GitHub auto-generate notes from the commits/PRs since the previous tag
gh release create v1.4.0 --title "v1.4.0" --generate-notes
# Or supply your own notes (e.g. distilled from the Conventional Commits in range):
# gh release create v1.4.0 --title "v1.4.0" --notes "..."
# Add --prerelease for -rc/-beta tags, or --draft to stage without publishing.Confirm the tag name, title, and whether it's a prerelease with the user first, then create it and report the release URL (gh release view v1.4.0 --json url). Don't create a release for a tag that already has one — check with gh release view <tag> and report it instead of duplicating.
If the repo is on GitHub and gh works, fetch the current metadata:
gh repo view --json name,description,repositoryTopics,homepageUrlCompare it against what the project now actually is (use the README, package manifest, and the changes you just pushed):
If everything is already accurate, say so and change nothing.
Description and topics are outward-facing. When a change is warranted:
Apply with:
gh repo edit <owner>/<repo> \
--description "..." \
--add-topic <topic>
# remove only when clearly justified and confirmed:
# --remove-topic <topic>Then verify and report the final description + topic list.
gh calls (only if on GitHub), a short proposal, and an edit. Don't turn it into a full repo audit.v<version> (per the project bump rules above), confirms it, tags, and — on GitHub — releases. Writing CHANGELOG.md and bumping the version manifest remain changelog-release's job; this skill just creates the git tag + GitHub Release, it does not touch package.json/CHANGELOG.md. Route the user there when they want a full changelog/manifest release rather than just a tag.changelogen) could later generate a changelog from git history alone.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.