Changelog Curator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Changelog Curator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill directs the agent to write or update a CHANGELOG.md that follows the Keep a Changelog format. It takes a list of commits, PR titles, or a git log dump, groups changes into the correct categories (Added, Changed, Fixed, Removed, Deprecated, Security), writes them in clear human-readable language, and formats the file correctly with semantic versioning and dates.
Use this before cutting a release, during sprint wrap-up, or when your changelog has fallen behind and you need to bring it up to date.
Copy this file to .agents/skills/changelog-curator/SKILL.md in your project root.
Then ask:
Provide:
git log --oneline vX.Y.Z..HEAD) or a list of PR titles/descriptionsCHANGELOG.md if one exists (so the agent can append, not overwrite)Add the instructions below to your .cursorrules or paste them into the Cursor AI pane. Paste the git log or PR list along with the version number.
Paste the git log or PR list, the current CHANGELOG.md if it exists, and the version number. Ask Codex to follow the instructions below.
When asked to write or update a changelog, follow these steps:
The input may be:
git log --oneline dumpFor each item, extract:
Use exactly these Keep a Changelog categories:
If a commit is unclear (e.g., "misc cleanup"), use your best judgment or place it under "Changed."
Rules for writing changelog entries:
## [X.Y.Z] - YYYY-MM-DD
### Security
- [Security fixes first, if any]
### Added
- [New feature 1]
- [New feature 2]
### Changed
- [Change 1]
### Deprecated
- [Deprecation 1]
### Removed
- [Removal 1]
### Fixed
- [Bug fix 1]
- [Bug fix 2]Only include sections that have entries. Don't include empty sections.
If an existing CHANGELOG.md is provided:
[Unreleased] section at the top if it exists; convert it to the new version[Unreleased] section remains (empty or reset) at the top after insertingIf no CHANGELOG.md exists, create one with this header:
# Changelog
All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [Unreleased]
[new version section here]Input to Agent:
"Use the Changelog Curator skill for v1.4.0 released today. Git log: `` a1b2c3d feat: add CSV export to reports page d4e5f6g fix: crash when user has no profile picture h7i8j9k fix: login redirect loop on mobile Safari l0m1n2o chore: upgrade lodash to 4.17.21 p3q4r5s feat: add dark mode toggle t6u7v8w security: patch XSS in comment renderer x9y0z1a feat: new /api/v2/users endpoint with pagination b2c3d4e fix: orders not showing for guest users ``"Output from Agent:
## [1.4.0] - 2026-03-15
>
### Security - Patched XSS vulnerability in the comment renderer
>
### Added - Added CSV export to the reports page - Added dark mode toggle - Added new /api/v2/users endpoint with pagination support>
### Changed - Updated lodash dependency to 4.17.21
>
### Fixed - Fixed crash when a user has no profile picture set - Fixed login redirect loop on mobile Safari - Fixed orders not displaying for guest users
⚠ Breaking prefix to the entry and consider adding a migration note.git log vX.Y.Z..HEAD --oneline to get the commit list for a specific range.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.