project-release-maintainer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited project-release-maintainer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This is a composable project overlay. Add matching implementation guidance when source, build, or automation code changes. Compose with documenter when the main artifact is durable release, install, or contributor documentation.
For review or planning, inspect and report without changing package contents, manifests, notices, or release state. Apply the workflow as edit instructions only when the user asks for those changes.
The change affects the shipped or published contract: package contents, install rules, release automation, shipped assets, license and notice files, release checklists, or documentation that must match those artifacts.
Use documenter alone for content-only edits that do not require reconciliation with shipped artifacts. For internal code changes with no release impact, use the matching principle skill and add project-core-dev only when repository- specific completion evidence is not concrete. Use project-config-and-tests for config contracts. Use project-vendor-boundary as primary for vendored source ownership, and compose both overlays when a vendor change also alters shipped metadata.
rules, shipped assets, release automation, license and notice files, checklists, and public documentation. Identify the source of truth before editing.
contents, install behavior, public commands, examples, and release notes mutually consistent.
commands. When install behavior changes, validate in a temporary install tree and clean it up; smoke-test the installed artifact when practical.
from build configuration alone. Report unavailable signing, platform, or publication checks instead of implying they passed.
CI, packaging, signing, publishing, or release workflows that the repo does not contain or the user did not request.
Treat tagging, publishing, uploading, signing, credential use, and creating an external release as separate consequential actions that require explicit authorization. Limit license work to keeping declared license and notice files consistent; do not make legal compatibility claims or change project licensing without explicit direction.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.