changelog-manager-dda08f — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited changelog-manager-dda08f (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When invoked, perform the following changelog management tasks: analyze git history and update CHANGELOG.md with well-written entries for the [Unreleased] section following the Keep a Changelog format.
No external skills are required. This skill operates independently.
Execute these steps in order:
CHANGELOG.md in the repository root: ls -la CHANGELOG.mddocs/CHANGELOG.mdCHANGES.md## [0.2.0])## [Unreleased]If no CHANGELOG.md exists, ask the user if they want one created.
Path filter note: If a path filter is provided in the prompt (e.g., -- agent-alchemy/sdd/), append it to all git log commands in this step to scope results to that sub-project.
git tag --list 'v*' --sort=-version:refname | head -5 git log v{version}..HEAD --format="%H|%s|%b" --no-merges [path_filter]If no tags exist, get recent commits with warning:
git log --format="%H|%s|%b" --no-merges -50 [path_filter] git log v{version}..HEAD --no-merges --oneline [path_filter] | grep -oE '#[0-9]+' | sort -u git show --stat {commit_sha}Purpose: Understand scope and impact of changes.
git diff v{version}..HEAD --name-status [path_filter] git diff v{version}..HEAD --dirstat [path_filter]| Path Pattern | Category | Changelog Relevance |
|---|---|---|
src/, lib/ | Core code | High |
tests/, __tests__/ | Tests | Low (skip) |
docs/, *.md | Documentation | Medium |
Root configs (*.json, *.toml) | Configuration | High |
.github/, CI files | CI/CD | Low (skip) |
Purpose: Detect API changes and breaking changes.
# Python: new functions/classes (public only, skip underscore-prefixed)
git diff v{version}..HEAD -- "*.py" | grep -E "^\+\s*(def |class )" | grep -v "_"
# JS/TS: new exports
git diff v{version}..HEAD -- "*.ts" "*.js" | grep -E "^\+.*export" # Python
git diff v{version}..HEAD -- "*.py" | grep -E "^-\s*(def |class )" | grep -v "_"
# JS/TS
git diff v{version}..HEAD -- "*.ts" "*.js" | grep -E "^-.*export" git diff v{version}..HEAD -- pyproject.toml package.json requirements*.txtnew_apis[] - new public functions/classesremoved_apis[] - BREAKINGmodified_apis[] - potentially breakingdependency_changes[]Purpose: Get richer context from PRs and issues.
which gh && gh auth status 2>/dev/null gh pr view {number} --json title,body,labels,filesbreaking-change, bug, feature, security)Primary: Use conventional commit prefixes:
| Prefix | Category | Include in Changelog |
|---|---|---|
feat: | Added | Yes |
fix: | Fixed | Yes |
refactor: | Changed | Yes (if user-facing) |
change: | Changed | Yes |
perf: | Changed | Yes |
security: | Security | Yes |
deprecate: | Deprecated | Yes |
remove: | Removed | Yes |
docs: | - | No (internal) |
chore: | - | No (internal) |
test: | - | No (internal) |
ci: | - | No (internal) |
style: | - | No (internal) |
build: | - | No (internal) |
Secondary signals (override/augment when detected):
| Signal | Category | Priority |
|---|---|---|
| Removed export detected | Removed + BREAKING | High |
PR label breaking-change | Add BREAKING flag | High |
PR label security | Security | High |
| New export detected | Added | Medium |
For commits without conventional prefixes, use diff analysis results to determine the appropriate category.
Entry sources (priority order):
Entry Format:
Add support for (authentication)Breaking change format:
### Removed
- **BREAKING**: Remove deprecated `oldFunction` (use `newFunction` instead)Group related changes when multiple commits touch same feature (>50% file overlap).
Show summary stats:
Analyzed N commits since vX.Y.Z:
- Files changed: X (Y core, Z tests)
- New APIs detected: X
- Removed APIs detected: X (BREAKING)
- PR context enriched: X of YProminent breaking changes section (if any detected):
BREAKING CHANGES DETECTED:
- Removed `oldFunction` from module.py
- Changed signature of `processData()`Show the user:
Prompt the user:
Based on {N} commits since v{version}, I suggest these changelog entries:
### Added
- Entry 1
- Entry 2
### Fixed
- Entry 3
### Changed
- Entry 4
Would you like to:Options:
Once approved, update CHANGELOG.md:
[Unreleased]Category Order (per Keep a Changelog):
Sub-project headings: When a scope is provided in the prompt, place entries under a sub-project heading within [Unreleased]:
## [Unreleased]
### sdd
#### Added
- New entry scoped to sdd
### agent-alchemy-tools
#### Fixed
- Fix scoped to agent-alchemy-toolsUse ### for sub-project names and #### for categories within them. If no scope is provided (default behavior), use ### for categories directly as usual.
| Scenario | Handling |
|---|---|
| No commits since release | Report "No new commits found since {version}" and exit gracefully |
| No tags exist | Use last 50 commits with warning to user |
| gh CLI unavailable | Skip PR enrichment, proceed with git data only |
| PR not found | Continue without that PR's context |
| Massive refactor (100+ files) | Warn about scope, suggest grouping entries |
| No conventional prefix | Use diff analysis for categorization |
| Merge commits in history | Skip merge commits (use --no-merges) |
| Commits already in changelog | Compare and skip duplicates |
| Squash-merged PRs | Treat as single entry, check PR for details |
Auto-flag as BREAKING:
Flag for review (ask user):
**BREAKING**: prefixThis skill requires the ability to read files, edit files, search for files and content, and execute shell commands (for git operations and gh CLI). It modifies CHANGELOG.md as its primary output.
This skill was converted from the changelog-manager agent in the dev-tools plugin package. It is typically delegated to by the release skill during Step 5 (Changelog Update Check). It can also be invoked independently to update the changelog at any time.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.