📦
dead-code-detector
79Find Dead Code Before Cleanup
Unused code slows reviews and increases maintenance risk. This skill helps Claude, Codex, and Claude Code identify removal candidates with review guidance.
Coding & Development View
Skills changelog-generator
📦
changelog-generator
Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Generate Release Changelogs
Release notes take time and can miss important commit details. This skill groups git commits into clear changelog sections with version guidance.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "changelog-generator" from https://skillstore.io/skills/curiouslearner-changelog-generator.md and its manifest at https://skillstore.io/api/skills/curiouslearner-changelog-generator/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "changelog-generator". Commits include feature export support, timezone fixes, and setup documentation updates.
Expected outcome:
Added: export support. Fixed: timezone parsing. Documentation: setup guide updates. Suggested version: minor.
Using "changelog-generator". A release contains a breaking authentication change and a token refresh fix.
Expected outcome:
Breaking changes appear first with migration notes. The suggested version is a major release.
Using "changelog-generator". A maintainer asks for unreleased changes since v2.1.0 with authors included.
Expected outcome:
- Changes are grouped by type.
- Each item includes author attribution.
- The release owner receives a review-ready draft.
Security Audit
Medium Riskv10 • 7/9/2026 Open versioned report
The skill is mostly release documentation guidance, but it includes executable Bash, Node.js, Python, and GitHub Actions examples. The main risks are shell command construction with unquoted git references and scripts that write CHANGELOG.md. I found no prompt injection attempt or malicious exfiltration intent.
1
Files scanned
849
Lines analyzed
7
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Unescaped Commit Text in Release Notes
The examples copy commit subjects and bodies into changelog entries and release bodies without escaping Markdown. A crafted commit message could create misleading links, mentions, or rendered content in published release notes.
Commit messages are parsed as text and appended directly to Markdown or GitHub release output. Impact depends on the renderer, so confidence is high for the behavior but moderate for exploitability.
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Node.js child_process module
const { execSync } = require('child_process');
The Node.js example imports child_process and uses execSync later in the same script. This enables shell execution when the generated script is copied or run.
High
Synchronous process execution
const output = execSync(cmd, { encoding: 'utf-8' });
The script passes a template-built git command to execSync through a shell. The tag value can come from --since, so crafted input can alter execution.
High
Ruby/shell backtick execution
? `git log ${tag}..HEAD --pretty=format:"%H|||%s|||%b|||%an|||%ae|||%ai"`
Although this is a JavaScript template literal, it inserts tag text into a shell command that is executed at line 400. This creates a command injection risk.
Medium
Shell command substitution
COMMITS=$(git log ${PREV_TAG}..HEAD --pretty=format:"%s|||%h|||%an" --reverse)
The Bash example expands PREV_TAG into a git log command without quotes. In an untrusted repository, crafted ref text could affect shell parsing.
Medium
Shell command substitution
CHANGELOG=$(git log ${PREV_TAG}..HEAD --pretty=format:"- %s (%h)" --reverse)
The GitHub Actions example expands PREV_TAG into a shell command without quotes. This is risky when workflow code runs on untrusted repository metadata.
Medium
Node.js fs operations
fs.writeFileSync('CHANGELOG.md', newLines.join('\n'));
The Node.js example writes directly to CHANGELOG.md in the working tree. This can overwrite release documentation without a dry-run or confirmation step.
Medium
Synchronous file operations
fs.writeFileSync('CHANGELOG.md', newLines.join('\n'));
The synchronous write overwrites CHANGELOG.md as part of the generated script. The fixed path limits scope, but it is still a local file modification risk.
Risk Factors
⚙️ External commands (50)
SKILL.md:375 SKILL.md:400 SKILL.md:543 SKILL.md:664 SKILL.md:52 SKILL.md:56-63 SKILL.md:63-69 SKILL.md:69-88 SKILL.md:88 SKILL.md:91-150 SKILL.md:150-156 SKILL.md:156-249 SKILL.md:249-253 SKILL.md:253-266 SKILL.md:266-269 SKILL.md:269-279 SKILL.md:279-283 SKILL.md:283-302 SKILL.md:302-305 SKILL.md:305-326 SKILL.md:326-331 SKILL.md:331-365 SKILL.md:365-371 SKILL.md:371-396 SKILL.md:396-397 SKILL.md:397-467 SKILL.md:467-475 SKILL.md:475-479 SKILL.md:479-500 SKILL.md:500-515 SKILL.md:515-520 SKILL.md:520-523 SKILL.md:523-527 SKILL.md:527-556 SKILL.md:556-561 SKILL.md:561-564 SKILL.md:564-606 SKILL.md:606-607 SKILL.md:607-608 SKILL.md:608-609 SKILL.md:609-617 SKILL.md:617-620 SKILL.md:620-629 SKILL.md:629-633 SKILL.md:633-756 SKILL.md:756-762 SKILL.md:762-809 SKILL.md:161 SKILL.md:165 SKILL.md:170
🌐 Network access (8)
📁 Filesystem access (16)
🔑 Env variables (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/curiouslearner-changelog-generator/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/curiouslearner-changelog-generator?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/curiouslearner-changelog-generator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/curiouslearner-changelog-generator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/curiouslearner-changelog-generator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CuriousLearner. (2026). changelog-generator security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/curiouslearner-changelog-generator/audits/10BibTeX citation
@techreport{curiouslearner-curiouslearner-changelog-generator-2026,
author = {CuriousLearner},
title = {changelog-generator security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/curiouslearner-changelog-generator/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "changelog-generator security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "CuriousLearner"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/curiouslearner-changelog-generator/audits/10"
identifiers:
- type: other
value: "skillstore:curiouslearner-changelog-generator:audit:10"
description: "Skillstore immutable audit report identifier"
Compare variants
5 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Higher Skillstore usage
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
davila7 Recommended
davila7-changelog-generator
Skillstore Score 79
Evidence Confidence High
Skillstore usage 13
Updated
2026-09-09
composiohq-changelog-generator
Skillstore Score 79
Evidence Confidence High
Skillstore usage 10
Updated
2026-09-30
dyai2025-changelog-generator
Skillstore Score 79
Evidence Confidence High
Skillstore usage 9
Updated
2026-09-09
doyajin174-changelog-generator
Skillstore Score 78
Evidence Confidence High
Skillstore usage 8
Updated
2026-09-09
CuriousLearner Current
curiouslearner-changelog-generator
Skillstore Score 50
Evidence Confidence High
Skillstore usage 8
Updated
2026-09-09
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
85
Content
72
Community
74
Spec Compliance
What You Can Build
Prepare Release Notes
Create a release-ready changelog from recent git commits and group changes by user impact.
Automate Changelog Updates
Add repeatable changelog generation to package scripts or CI release workflows.
Assess Version Impact
Review commit history for breaking changes and choose a semantic version bump.
Try These Prompts
Create Basic Changelog
Generate a Keep a Changelog entry from commits since the latest tag. Group changes by type and flag breaking changes.
Add Release Metadata
Create release notes for version 1.4.0. Include commit hashes, authors, dates, and separate sections for fixes and features.
Recommend Version Bump
Analyze commits since v1.3.2 and recommend the next semantic version. Explain any breaking changes and migration notes.
Design Safe Automation
Draft a secure changelog automation workflow. Include dry-run review, safe git argument handling, and explicit approval before file writes.
Best Practices
- Review generated entries for customer impact before release.
- Use Conventional Commits consistently with clear scopes.
- Run automation on a test branch before writing CHANGELOG.md.
Avoid
- Do not publish raw commit subjects without editing unclear wording.
- Do not run shell snippets against untrusted tags without quoting.
- Do not treat version suggestions as final without release owner review.
Frequently Asked Questions
Does this require Conventional Commits?
It works best with Conventional Commits, but it can group other commit messages under general change sections.
Can it update an existing changelog?
The examples show how to insert new entries into CHANGELOG.md, but changes should be reviewed before saving.
Does it choose the next version?
It suggests a semantic version bump based on features, fixes, and breaking changes.
Can it run in CI?
Yes. The skill includes GitHub Actions examples for release notes and package publishing workflows.
Does it fetch data from the internet?
The skill itself is guidance. Some examples reference GitHub, npm, or release actions when used in CI.
Is the generated output ready to publish?
No. A maintainer should review wording, links, breaking changes, and version decisions before release.
Developer Details
Author
CuriousLearnerLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
0519034dad657fb1f7706e0550e962beeda73fdf
Maintenance freshness
7/18/2026
Usage
4 downloads · 333 views
File structure
📄 SKILL.md
More from CuriousLearner
View all📦
code-reviewer
78Review Code for Quality and Security
Code reviews can miss security, testing, and maintainability issues when reviewers lack time. This skill guides Claude, Codex, and Claude Code through a structured review with prioritized findings.
Coding & Development View
📦
dependency-updater
78Audit Dependency Updates Safely
Dependency updates can hide breaking changes and security urgency. This skill reviews project manifests, summarizes update risk, and recommends an order for safe upgrades.
DevOps & Infrastructure View
📦
refactor-assistant
78Refactor Code Safely with Structured Guidance
Refactoring can introduce bugs when changes are broad or poorly explained. This skill helps Claude, Codex, and Claude Code plan and apply safer incremental improvements.
Coding & Development View
📦
performance-profiler
78Profile Application Performance Bottlenecks
Slow code can hide inside algorithms, rendering, database queries, and bundles. This skill reviews source patterns and produces prioritized optimization guidance.
Coding & Development View
📦
log-analyzer
78Analyze Application Logs Faster
Log files hide service failures, error spikes, and slow requests. This skill turns raw logs into structured findings, timelines, and practical remediation guidance.
DevOps & Infrastructure View
Related Skills
View all📦
changelog
79Maintain Accurate IdeaVim Changelogs
by JetBrains
Release notes become inconsistent when commits, tickets, and user impact are reviewed separately. This skill turns repository history into organized, user-focused IdeaVim changelog entries.
Documentation View
📦
changelog-maintenance
78Maintain Release Changelogs
by supercent-io
Release updates are hard to track when changes are scattered across tickets and commits. This skill organizes changelogs, release notes, and migration guidance into clear user-facing documents.
Documentation View
📦
github-release-assistant
83Generate Bilingual GitHub Release READMEs
by ZhanlinCui
Release notes and README updates can take time before each GitHub release. This skill generates bilingual release documentation and guides review, commit, and push steps.
Documentation View
📦
markdown-pro
79Create Professional Markdown Documentation
by AutumnsGrove
Inconsistent project documentation makes installation, use, and contribution difficult. This skill supplies structured templates, formatting guidance, and local tools for maintainable Markdown.
Documentation View
📦
documentation-and-adrs
78Document Decisions and Architecture Clearly
by addyosmani
Teams lose context when important technical decisions remain in chat, code comments, or individual memory. This skill turns architectural reasoning, API guidance, project instructions, and release changes into structured documentation.
Documentation View
📦
nestjs-git-commit-pr-message
79Prepare NestJS Commits and Pull Requests
by amirtaherkhani
Mixed changes and unclear publication requests can produce misleading commits or unintended remote updates. This skill guides verified Git changes and accurate messages within authorized scope.
Coding & Development View