Changelog Watcher

Monitor GitHub repos and npm packages for new releases and version updates. Summarizes changelogs and highlights breaking changes. Use when the user asks to...

Security Scan

The skill's code, instructions, and requirements are consistent with its stated purpose of monitoring GitHub and npm releases and producing changelog reports.

Purpose & Capability

Name/description (monitor GitHub and npm for releases, summarize changelogs) matches the included scripts and runtime instructions. The watchlist/state files, GitHub API calls, and npm registry calls are exactly what you'd expect for this functionality.

Instruction Scope

SKILL.md instructs the agent and user to create/edit watchlist.json, run compare_versions.py and format_report.py, and optionally schedule a cron job. The scripts read/write only local files in the skill workspace (watchlist.json, state.json) and call public APIs (api.github.com, registry.npmjs.org). No instructions ask the agent to read unrelated system files or exfiltrate data. Note: the guide mentions an optional GITHUB_TOKEN to raise rate limits, which is reasonable but is not required.

Install Mechanism

This is an instruction-only skill with bundled Python scripts and no install spec or external downloads. Nothing is written to disk by an installer; risk from installation is low.

Credentials

The skill declares no required environment variables. The documentation correctly calls out an optional GITHUB_TOKEN to increase rate limits; that optional credential is proportional and justified. No other secrets or unrelated credentials are requested.

Persistence & Privilege

always is false and the skill does not request elevated or cross-skill privileges. It writes state.json and (when scheduled) report files inside its own workspace — this is expected behavior for a watcher and scoped to the skill's directory.

Assessment

This skill appears to do what it says, but review these practical points before installing: 1) Inspect and edit assets/watchlist.example.json to create your watchlist.json so you only monitor repos/packages you intend. 2) The scripts read/write state.json in ~/.openclaw/workspace/skills/changelog-watcher — back it up if you care about previous state. 3) GitHub rate limits apply (60/hr unauthenticated); provide a GITHUB_TOKEN only if you trust the runtime environment. 4) The bundled scripts are Python; ensure the environment's python3 is recent enough (some type hints suggest Python 3.9+). 5) If scheduling via cron, create the reports directory with appropriate permissions to avoid overwriting sensitive data. 6) As always, run the scripts in an environment/network you control and review the included scripts (they are short, human-readable) before granting network access.

Maintains a watchlist of GitHub repos and npm packages, detects new releases, and produces markdown reports with breaking changes highlighted.

Files

• watchlist.json — user config (create from assets/watchlist.example.json)
• state.json — auto-managed last-seen versions (do not edit)
• scripts/compare_versions.py — main entry point; calls the others
• scripts/check_github.py — GitHub releases API
• scripts/check_npm.py — npm registry
• scripts/format_report.py — markdown report generator

For setup, watchlist format, cron scheduling, and rate limit guidance → read references/setup-guide.md.

Skill Directory

~/.openclaw/workspace/skills/changelog-watcher/

All script paths below are relative to this directory.

Usage

Check for new releases and print report

python3 scripts/compare_versions.py --update-state | python3 scripts/format_report.py

Dry-run (check without advancing state)

python3 scripts/compare_versions.py | python3 scripts/format_report.py

First-time setup (set baseline, no output)

cp assets/watchlist.example.json watchlist.json
# edit watchlist.json to your packages
python3 scripts/compare_versions.py --update-state

Workflow

1. Confirm watchlist.json exists. If not, guide user to copy from assets/watchlist.example.json and fill it in.
2. Run compare_versions.py (with --update-state unless doing a dry-run).
3. Pipe output to format_report.py.
4. Present the markdown report to the user.
5. If the user wants to schedule this: provide the cron line from references/setup-guide.md.

Adding Entries

To add a GitHub repo:

{"source": "github", "owner": "OWNER", "repo": "REPO", "name": "Display Name"}

To add an npm package:

{"source": "npm", "package": "package-name", "name": "Display Name"}

Append to the watch array in watchlist.json, then run the full pipeline.

Error Handling

• Rate limited (exit 2): Wait for the retry window; check how many GitHub entries are in the watchlist vs the 60/hr limit.
• Not found (exit 3): Verify the owner/repo or package name in the watchlist.
• Network error: Check connectivity; retry.
• First-run shows zero releases: Expected — first run sets the baseline only.