release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are in AUTONOMOUS MODE. Do NOT ask questions. Do NOT pause for confirmation. Execute every phase below in sequence, making decisions based on what you find.
============================================================ PHASE 0 — INPUT ============================================================
$ARGUMENTS may contain:
--tool=TOOL — force a specific release tool: semantic-release, changesets, release-please, cargo-release, goreleaser--publish=TARGET — where to publish: npm, pypi, crates, ghcr, github (GitHub Releases only)--monorepo — configure for monorepo with independent package versioning--dry-run — generate config files but do not create any CI workflows--channel=CHANNEL — set release channel: latest (default), next, beta, alphaIf no arguments, auto-detect the best tool and target.
============================================================ PHASE 1 — STACK DETECTION ============================================================
Detect the project stack and current release state:
Language & Package Registry:
package.json → npm (check publishConfig, private field, name scope)pyproject.toml → PyPI (check [project] or [tool.poetry] section)Cargo.toml → crates.io (check publish field)go.mod → Go modules (tag-based releases)pubspec.yaml → pub.dev (check publish_to)Current Versioning:
git tag --list 'v*' --sort=-version:refname | head -5.github/workflows/Monorepo Detection:
turbo.json / nx.json / pnpm-workspace.yaml / lerna.jsonpackage.json files in subdirectoriesExisting Commit Convention:
git log --oneline -20 to see if they follow a pattern.husky/commit-msg or equivalent hookRecord: language, registry, current version, monorepo status, commit convention.
============================================================ PHASE 2 — SELECT AND CONFIGURE RELEASE TOOL ============================================================
If Node.js single-package → semantic-release:
npm install --save-dev semantic-release @semantic-release/changelog @semantic-release/git.releaserc.json: {
"branches": ["main"],
"plugins": [
"@semantic-release/commit-analyzer",
"@semantic-release/release-notes-generator",
["@semantic-release/changelog", { "changelogFile": "CHANGELOG.md" }],
["@semantic-release/npm", { "npmPublish": true }],
["@semantic-release/git", {
"assets": ["CHANGELOG.md", "package.json"],
"message": "chore(release): ${nextRelease.version}"
}],
"@semantic-release/github"
]
}Adjust: set "npmPublish": false if package.json has "private": true. If --channel specified, add branch config for pre-release channels.
npm install --save-dev @commitlint/cli @commitlint/config-conventionalCreate commitlint.config.js:
export default { extends: ['@commitlint/config-conventional'] };If Node.js monorepo → changesets:
npm install --save-dev @changesets/cli @changesets/changelog-githubnpx changeset init.changeset/config.json: {
"$schema": "https://unpkg.com/@changesets/[email protected]/schema.json",
"changelog": ["@changesets/changelog-github", { "repo": "{owner}/{repo}" }],
"commit": false,
"fixed": [],
"linked": [],
"access": "public",
"baseBranch": "main",
"updateInternalDependencies": "patch",
"ignore": []
}Detect repo name from git remote get-url origin.
If Python → semantic-release (Python):
pip install python-semantic-release (or add to dev dependencies)pyproject.toml: [tool.semantic_release]
version_toml = ["pyproject.toml:project.version"]
branch = "main"
commit_message = "chore(release): {version}"
build_command = "pip install build && python -m build"If publishing to PyPI, add:
upload_to_pypi = trueIf Go → goreleaser:
.goreleaser.yml: version: 2
builds:
- env: [CGO_ENABLED=0]
goos: [linux, darwin, windows]
goarch: [amd64, arm64]
archives:
- format: tar.gz
name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
format_overrides:
- goos: windows
format: zip
changelog:
sort: asc
filters:
exclude: ["^docs:", "^test:", "^chore:"]If Rust → cargo-release:
cargo install cargo-releaseCargo.toml: [workspace.metadata.release]
sign-commit = false
sign-tag = false
push = true
publish = trueIf release-please requested:
.release-please-manifest.json: { ".": "0.1.0" }release-please-config.json: {
"packages": { ".": { "release-type": "{node|python|go|...}" } },
"changelog-sections": [
{ "type": "feat", "section": "Features" },
{ "type": "fix", "section": "Bug Fixes" },
{ "type": "perf", "section": "Performance" },
{ "type": "docs", "section": "Documentation" }
]
}============================================================ PHASE 3 — GENERATE CI WORKFLOW ============================================================
Skip if --dry-run was passed.
Create .github/workflows/release.yml:
For semantic-release:
name: Release
on:
push:
branches: [main]
permissions:
contents: write
issues: write
pull-requests: write
packages: write
jobs:
release:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
persist-credentials: false
- uses: actions/setup-node@v4
with:
node-version: 20
cache: npm
- run: npm ci
- run: npx semantic-release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}For changesets:
name: Release
on:
push:
branches: [main]
permissions:
contents: write
pull-requests: write
jobs:
release:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 20
cache: npm
- run: npm ci
- uses: changesets/action@v1
with:
publish: npm run release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}For release-please:
name: Release
on:
push:
branches: [main]
permissions:
contents: write
pull-requests: write
jobs:
release-please:
runs-on: ubuntu-latest
steps:
- uses: googleapis/release-please-action@v4
with:
release-type: nodeFor goreleaser:
name: Release
on:
push:
tags: ['v*']
permissions:
contents: write
jobs:
goreleaser:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
- uses: goreleaser/goreleaser-action@v6
with:
args: release --clean
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}Adjust for Python/Rust equivalents as appropriate.
============================================================ PHASE 4 — VERIFY CONFIGURATION ============================================================
npx semantic-release --dry-runnpx changeset statusgoreleaser check============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After completing, validate the output was produced correctly:
IF VALIDATION FAILS:
============================================================ OUTPUT ============================================================
Print a summary:
## Release Pipeline Setup Complete
### Tool: {semantic-release | changesets | release-please | goreleaser | cargo-release}
### Current Version: {version}
### Publish Target: {npm | pypi | crates.io | GitHub Releases}
### Release Channel: {latest | next | beta}
### How It Works
1. Write code using conventional commits (feat:, fix:, etc.)
2. Push/merge to main
3. {tool} analyzes commits since last release
4. Automatically: bumps version, generates changelog, creates git tag, publishes
### Commit → Release Mapping
- `feat:` → minor version bump (0.1.0 → 0.2.0)
- `fix:` → patch version bump (0.1.0 → 0.1.1)
- `feat!:` or `BREAKING CHANGE:` → major version bump (0.1.0 → 1.0.0)
- `docs:`, `chore:`, `ci:` → no release
### Files Created/Modified
- {list of files}
### Required Secrets
- GITHUB_TOKEN: automatic (provided by GitHub Actions)
- NPM_TOKEN: {required if publishing to npm — generate at npmjs.com}
- {other secrets as applicable}============================================================ NEXT STEPS ============================================================
/git-hooks to enforce conventional commits locally if not already set upfeat: commit and push to main to trigger the first releasenpx changeset before merging PRs to document changes============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /release — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
============================================================ DO NOT ============================================================
GITHUB_TOKEN for npm publishing — it requires a separate NPM_TOKENfetch-depth: 1 in the release workflow — semantic-release needs full git history~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.