version-bump — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited version-bump (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Before pushing changes in a marketplace project, check if any plugin files have been modified and guide the user through appropriate semver version bumps. This prevents plugins from being updated without their version reflecting the change — which matters for users who install plugins and need to know when updates are available.
A marketplace project has a .claude-plugin/marketplace.json file at the repository root. If this file doesn't exist, this skill doesn't apply — proceed with the push normally without mentioning this skill.
Compare the current branch against the remote tracking branch:
git diff --name-only @{upstream}...HEAD 2>/dev/nullIf there's no upstream yet (new branch), compare against the default branch (main or master).
Filter the results for paths matching plugins/<plugin-name>/... and extract the unique plugin names.
If no plugin files changed (only root-level files like README.md), skip version bumping and proceed with the push.
For each affected plugin, read the current version from:
plugins/<name>/.claude-plugin/plugin.json.claude-plugin/marketplace.jsonFlag any version mismatches between the two files — the user should know if they've drifted out of sync.
If a plugin doesn't have a version field in its plugin.json, note this and suggest adding one.
For each affected plugin, look at the actual diff to categorize the changes:
Patch (x.y.Z) — backwards-compatible fixes:
Minor (x.Y.0) — backwards-compatible additions:
Major (X.0.0) — breaking changes:
name field in frontmatter)Present each plugin with:
Ask the user to confirm or override the suggestion for each plugin.
Before making any changes, explicitly ask the user which files to update. Present these as options:
plugins/<name>/.claude-plugin/plugin.json only.claude-plugin/marketplace.json onlyDo not assume "both" — wait for the user's answer. Then read each chosen file, update only the version field, and write it back.
After applying version bumps:
chore: bump <plugin-name> to <new-version> (or a combined message if multiple plugins were bumped)1.0.0.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.