release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
git checkout main && git pullgit status --porcelain=v1 (must be clean)mainpackages/node (or anything that affects the legacy transloadit clone):corepack yarn check (this may reformat files and/or auto-fix Knip findings)corepack yarn verify:full locally once before pushing.verify / verify:full fails with transloadit wrapper drift, run node scripts/prepare-transloadit.ts, commit the tracked packages/transloadit updates, and re-run corepack yarn verify:full.@transloadit/node, also add a similar changeset for @transloadit/mcp-server if it could affect its workings. The chances are, they are, since the latter is mostly a thin wrapper around the former.yarn check/yarn verify will fail fast if you forget.Notes:
gh pr create from a shell, avoid unescaped backticks in the --body string.Prefer --body-file to prevent accidental command substitution.
gh run watch heavily, GitHub may throttle with HTTP 429.Prefer gh pr checks <PR_NUMBER> with occasional polling (or use the web UI) if you hit throttling.
Optional parity playbook (release/debug only):
node scripts/prepare-transloadit.tsnode scripts/fingerprint-pack.ts ./packages/transloadit --ignore-scripts --quiet --out ./docs/fingerprint/transloadit-baseline.jsoncp ./packages/transloadit/package.json ./docs/fingerprint/transloadit-baseline.package.jsoncorepack yarn fix:jscorepack yarn parity:transloaditVersion Packages PR to appear (or update)git fetch origin changeset-release/maingit checkout changeset-release/mainyarn.lock is up to date (CI will fail otherwise):corepack yarnyarn.lock changed: git add yarn.lock && git commit -m "chore: update yarn.lock for release" && git push# Releases section (this is the authoritative "what will publish")@transloadit/node and transloadit), ensure the PR updates both.If it doesn't, fix before merging (otherwise tags/releases can drift).
Notes:
gh run list --branch changeset-release/main --limit 3git checkout main && git pullcorepack yarnyarn.lock changed: git add yarn.lock && git commit -m "chore: update yarn.lock for release" && git pushcorepack yarn with immutable installs and will fail if it would modify yarn.lock.corepack yarn check (catches formatting/knip/ts/unit drift early)packages/transloadit clone from drifting (special case):transloadit package exists in this repo, keep it in sync with @transloadit/node by running:git checkout main && git pullnode scripts/prepare-transloadit.tsnode scripts/fingerprint-pack.ts ./packages/transloadit --ignore-scripts --quiet --out ./docs/fingerprint/transloadit-baseline.jsoncp ./packages/transloadit/package.json ./docs/fingerprint/transloadit-baseline.package.jsoncorepack yarn checkmainRelease workflow on main:gh run list --workflow Release --branch main --limit 5gh run watch <run_id><pkg>@<version>)main:git checkout main && git pullgit tag <pkg>@<version>git push origin <pkg>@<version>gh release create <pkg>@<version> --generate-notesVersion Packages PR, read the # Releases section to get the authoritative list.<pkg>@<version> in the # Releases section:npm view <pkg> version (should match)git tag -l '<pkg>@<version>' (tag should exist)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.