Release Skills

PassAudited by ClawScan on May 1, 2026.

Overview

This release helper is coherent and purpose-aligned, but it can modify version/changelog files and create or push Git commits and tags.

Before installing or using it, verify the source, run dry-run mode, review the proposed file changes and changelog, and only approve Git commits, tags, or pushes for the intended repository and branch.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used incorrectly, it could create unwanted release commits, tags, or remote changes in the repository.

Why it was flagged

The workflow includes repository-mutating Git operations, including commits, tags, and optional push.

Skill content
git add <version-file> CHANGELOG*.md ... git commit -m "chore: release v{VERSION}" ... git tag v{VERSION} ... git push origin main
Recommendation

Use dry-run first, review the diff, version, branch, and tag name, and only approve push operations when you are sure they target the correct remote.

What this means

The skill can publish changes using whatever Git access the local environment already has.

Why it was flagged

Pushing to a remote repository uses the user's configured Git identity and repository permissions.

Skill content
Push to remote? (Yes/No) ... git push origin main ... git push origin v{VERSION}
Recommendation

Confirm the repository, branch, and remote account before approving a push, and rely on branch protections where possible.

What this means

Installing from an unpinned branch can pull different content later than what was reviewed here.

Why it was flagged

The documented install command references a moving GitHub branch rather than a pinned release or digest.

Skill content
npx add https://github.com/wpank/ai/tree/main/skills/tools/release-skills
Recommendation

Prefer a pinned version, tag, or trusted registry source, and review the repository before installing.