Release Notes Generator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Release Notes Generator (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill takes raw git log output or a list of PR titles/descriptions and turns them into polished, user-facing release notes. It groups changes by category, rewrites technical commit messages into plain English, and formats the output as clean markdown ready to paste into GitHub Releases, a CHANGELOG.md, or a blog post.
Use this before every release to save time and produce consistent, readable changelogs your users will actually understand.
Copy this file to .agents/skills/release-notes-generator/SKILL.md in your project root.
Then run:
git log v1.2.0..v1.3.0 --onelinePaste the output and ask:
Add the "Prompt / Instructions" section below to your .cursorrules file, then paste your git log or PR list into the chat.
Paste your git log or PR descriptions directly into the chat along with the instructions below. Include PR body text when available — it gives Codex more context for accurate categorization.
When asked to generate release notes, follow these steps:
git log --oneline output (hash + short message)git log with commit bodiesIf a change doesn't clearly fit a category, use your best judgment. Omit pure chore commits (chore: update lockfile) unless they affect users.
## v[VERSION] — [DATE]
[Optional 2–3 sentence summary of the release highlights.]
### Breaking Changes
- ...
### New Features
- ...
### Improvements
- ...
### Bug Fixes
- ...
### Security
- ...
### Under the Hood
- ...Omit any section that has no entries.
Input to Agent:
"Use the Release Notes Generator skill on this git log for v2.1.0:
>
`` a3f2c1e feat(auth): add OAuth2 login with Google and GitHub 9b1d4a7 fix(dashboard): chart not rendering on Safari 16 cc8e302 perf(api): reduce response time by 40% with query caching 5f3a991 chore: bump eslint from 8.0 to 9.0 2d7c14e feat(export): add CSV export for all report types b8a0f3c fix(upload): files over 10MB silently failed e1c5529 refactor(db): replace raw SQL with query builder 7fa3318 BREAKING: rename config key api_url to apiUrl ``"Output from Agent:
## v2.1.0 — 2026-03-15
>
This release adds Google and OAuth2 login, a long-requested CSV export, and a significant API speed improvement. One configuration key has been renamed — see the breaking change note below.
>
### Breaking Changes - The configuration keyapi_urlhas been renamed toapiUrl. Update your config file before upgrading.
>
### New Features - Sign in with Google or GitHub using OAuth2 — no password required. - Export any report as a CSV file with a single click.
>
### Improvements - API responses are now up to 40% faster thanks to query result caching.
>
### Bug Fixes - Fixed charts not rendering correctly in Safari 16. - Fixed an issue where file uploads larger than 10 MB would fail silently with no error message.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.