release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Automates the release process for the xhs-mcp package with intelligent version detection.
Analyze changes since the last tag to determine version bump:
src/tools/npm installWhen the user invokes /release:
node -p "require('./package.json').version"
git describe --tags --abbrev=0 2>/dev/null || echo "none" git log $(git describe --tags --abbrev=0 2>/dev/null || echo "HEAD~10")..HEAD --oneline npm install git add package.json package-lock.json
git commit -m "chore: release v{NEW_VERSION}
Co-Authored-By: Claude Opus 4.5 <[email protected]>"
git tag v{NEW_VERSION} git push && git push --tags gh release create v{NEW_VERSION} --title "v{NEW_VERSION}" --notes "{RELEASE_NOTES}" Changes detected: {summary}
Version bump: {type} ({old} → {new})
✓ Updated package.json
✓ Synced package-lock.json
✓ Committed: chore: release v{new}
✓ Tagged: v{new}
✓ Pushed to remote
✓ GitHub Release created
npm publish workflow triggered: https://github.com/ShunL12324/xhs-mcp/actionsAnalyzing changes since v1.0.0...
Commits:
- feat: add xhs_publish_video tool
- fix: handle empty search results
- chore: update dependencies
Detected: New feature added (feat:)
Version bump: minor (1.0.0 → 1.1.0)
✓ Updated package.json
✓ Synced package-lock.json
✓ Committed: chore: release v1.1.0
✓ Tagged: v1.1.0
✓ Pushed to remote
✓ GitHub Release created
npm publish workflow triggered: https://github.com/ShunL12324/xhs-mcp/actionsnpm ci fails in GitHub ActionsThis happens when package-lock.json is out of sync with package.json. The workflow now includes npm install step to prevent this.
If a release fails and needs to be retried:
gh release delete v{VERSION} --yes
git tag -d v{VERSION}
git push origin :refs/tags/v{VERSION}
# Then re-run the release process~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.