utility-pm-release-conductor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited utility-pm-release-conductor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- PM-Skills | https://github.com/product-on-purpose/pm-skills | Apache 2.0 -->
Cross-client dispatch wrapper for the pm-release-conductor sub-agent. Detects runtime; dispatches to the native sub-agent on Claude Code; reads agents/pm-release-conductor.md and inlines chain composition on non-Claude clients via "reference + execute inline" pattern.
Status summary (v2.16.0): PRODUCTION on Claude Code (native sub-agent path). DRY-RUN VALIDATED on Codex CLI 2026-05-17 pergate-test-results_2026-05-17_codex.md; LIVE release on Codex CLI is NOT independently exercised, so use with caution and run--dry-runfirst as a rehearsal. EXPERIMENTAL on Cursor / Windsurf / Copilot CLI / Gemini CLI (UNTESTED at v2.16.0 ship).
>
See Sub-Agent Compatibility Matrix for the canonical safe-usage matrix + what-was-validated detail + v2.17 expansion plan. For live release on a non-Claude client, ideally re-run the harness at maintainer-gate-testing-codex.md on that specific client first.utility-pm-criticutility-pm-skill-auditorutility-pm-changelog-curatorRuntime detection step. Determine which AI client is invoking this skill.
Invoke @agent-pm-skills:pm-release-conductor with the user's target version + optional flags from $ARGUMENTS. The native sub-agent walks the 6 gates and natively chains to pm-skill-auditor (G0, G2.5) and pm-changelog-curator (G2) via the Agent tool. Return the conductor's gate-by-gate output to the user.
Codex CLI, Cursor, Windsurf, Copilot, Gemini CLI, or any other client without native pm-skills plugin sub-agent support:
agents/pm-release-conductor.mddocs/contributing/release-runbook.md (the conductor's referential source for gate definitions)agents/pm-skill-auditor.md and execute the auditor's 4-step audit flow inline. Capture the layered output (full findings + Status Summary + Status YAML). Treat the Status YAML as your G0 sub-check 5 input.agents/pm-changelog-curator.md and execute the curator's 8-step drafting flow inline. Capture the layered output. Treat the Status YAML as your G2 sub-check 3 input.The "reference + execute inline" pattern is what enables cross-client compatibility for chain composition. Phase 2 GATE C sub-spike validates that this pattern is reliable.
Because non-Claude clients cannot natively chain, the auditor and curator behaviors run in the SAME context window as the conductor on non-Claude clients. This has implications:
agents/pm-release-conductor.mddocs/contributing/release-runbook.mddocs/internal/release-plans/v2.16.0/spec_pm-release-conductor.mdagents/pm-skill-auditor.mdagents/pm-changelog-curator.mdscripts/pre-tag-validate.{sh,ps1}docs/reference/runtime-components.mdreferences/TEMPLATE.mdreferences/EXAMPLE.md~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.