Skills github-release-management
📦
github-release-management
v2.0.0 Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Manage GitHub Releases
Release work often spans versioning, testing, changelogs, artifacts, and deployment checks. This skill gives Claude, Codex, and Claude Code a structured release workflow.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "github-release-management" from https://skillstore.io/skills/dnyoussef-github-release-management.md and its manifest at https://skillstore.io/api/skills/dnyoussef-github-release-management/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "github-release-management". Plan release v2.0.0 for a Node package.
Expected outcome:
A release checklist covering branch creation, version bump, changelog draft, test and build validation, release pull request, npm publish approval, and monitoring.
Using "github-release-management". Create release notes from merged pull requests.
Expected outcome:
Categorized release notes with features, fixes, breaking changes, contributors, migration guidance, and known issues.
Using "github-release-management". Prepare an emergency hotfix process.
Expected outcome:
A focused hotfix plan with branch source, cherry-pick steps, critical tests, approval gate, publication steps, announcement, and rollback checks.
Security Audit
High Riskv8 • 7/5/2026 Open versioned report
The skill is a Markdown release-automation guide with many static false positives from code fences. Real risks remain in shell command substitutions, predictable /tmp files, GitHub and npm token handling, and credentialed publish/deploy workflows.
1
Files scanned
1,082
Lines analyzed
24
Review items
0
False positives ignored
Confirmed security concerns (3)
High
NPM config file (may contain tokens)
echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc
The workflow writes secrets.NPM_TOKEN into .npmrc before publishing. Credential files can persist in workspaces, caches, or artifacts if cleanup is not enforced.
High
Credentialed Package and Image Publication
The release workflow includes npm publish and Docker image push steps after writing registry credentials. If run without approval, the skill can cause credentialed package and image releases.
The cited workflow directly publishes to npm and pushes Docker images using CI context. This is a clear high-impact release action, even though it is aligned with the skill purpose.
Medium
Fast-Track Emergency Release Path
The emergency hotfix guidance creates releases and publishes hotfix packages with fast-track flags. Without an approval gate, this can ship unreviewed changes during an incident.
The cited sections explicitly create hotfix releases, publish packages, and call an emergency-release command with --fast-track. The risk is operational misuse rather than hidden malicious code.
Capability review items (24)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Git platform tokens
run: echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
The workflow pipes secrets.GITHUB_TOKEN into gh auth login and grants write-capable release operations. This is expected for CI, but it materially expands the impact of misuse.
Medium
Shell command substitution
LAST_TAG=$(gh release list --limit 1 --json tagName -q '.[0].tagName')
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
CHANGELOG=$(gh api repos/:owner/:repo/compare/${LAST_TAG}...HEAD \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
gh release create $(npm pkg get version) \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
Bash("gh api repos/:owner/:repo/git/refs --method POST -f ref='refs/heads/release/v2.0.0' -f sha=$(g
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
--body "$(cat RELEASE_NOTES.md)"`)
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
PRS=$(gh pr list --state merged --base main --json number,title,labels,author,mergedAt \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
COMMITS=$(gh api repos/:owner/:repo/compare/v1.0.0...HEAD \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
PREV_TAG=$(gh release list --limit 2 --json tagName -q '.[1].tagName')
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
PRS=$(gh pr list --state merged --base main --json number,title,labels,author,mergedAt \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
COMMITS=$(gh api repos/${{ github.repository }}/compare/${PREV_TAG}...HEAD \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
CHANGELOG=$(npx claude-flow@alpha github changelog \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
--commits "$(cat /tmp/release-commits.txt)" \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
--notes "$(cat RELEASE_CHANGELOG.md)" \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
--body "$(cat RELEASE_CHANGELOG.md)" \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
-f body="$(cat RELEASE_CHANGELOG.md)" \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
-f category_id="$(gh api repos/${{ github.repository }}/discussions/categories --jq '.[] | select(.s
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
LAST_STABLE=$(gh release list --limit 1 --json tagName -q '.[0].tagName')
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
HOTFIX_VERSION=$(echo $LAST_STABLE | awk -F. '{print $1"."$2"."$3+1}')
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Shell command substitution
docker run --rm -v $(pwd):/app node:20 \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
Medium
Temp directory access
echo "$PRS" > /tmp/release-prs.json
The workflow writes release metadata to predictable /tmp paths and reads it back later. In shared or reused runners this can cause clobbering or unintended disclosure.
Medium
Temp directory access
echo "$COMMITS" > /tmp/release-commits.txt
The workflow writes release metadata to predictable /tmp paths and reads it back later. In shared or reused runners this can cause clobbering or unintended disclosure.
Medium
Temp directory access
--prs "$(cat /tmp/release-prs.json)" \
The workflow writes release metadata to predictable /tmp paths and reads it back later. In shared or reused runners this can cause clobbering or unintended disclosure.
Medium
Temp directory access
--commits "$(cat /tmp/release-commits.txt)" \
The workflow writes release metadata to predictable /tmp paths and reads it back later. In shared or reused runners this can cause clobbering or unintended disclosure.
Risk Factors
⚙️ External commands (99)
SKILL.md:31-43 SKILL.md:43-46 SKILL.md:46-52 SKILL.md:52-89 SKILL.md:89-103 SKILL.md:103-106 SKILL.md:106-112 SKILL.md:112-115 SKILL.md:115-123 SKILL.md:123-126 SKILL.md:126-141 SKILL.md:141-150 SKILL.md:150-166 SKILL.md:166-169 SKILL.md:169-191 SKILL.md:195-217 SKILL.md:217-222 SKILL.md:222-239 SKILL.md:239-249 SKILL.md:249-256 SKILL.md:256-266 SKILL.md:266-273 SKILL.md:273-283 SKILL.md:283-290 SKILL.md:290-293 SKILL.md:293-300 SKILL.md:300-309 SKILL.md:309-331 SKILL.md:333-334 SKILL.md:334-339 SKILL.md:339-367 SKILL.md:367-370 SKILL.md:370-378 SKILL.md:378-383 SKILL.md:383-391 SKILL.md:391-394 SKILL.md:394-412 SKILL.md:412-417 SKILL.md:417-427 SKILL.md:427-430 SKILL.md:430-442 SKILL.md:445-451 SKILL.md:454-455 SKILL.md:455-464 SKILL.md:464-574 SKILL.md:574-579 SKILL.md:579-595 SKILL.md:595-598 SKILL.md:598-606 SKILL.md:606-609 SKILL.md:609-617 SKILL.md:617-622 SKILL.md:622-630 SKILL.md:630-633 SKILL.md:633-641 SKILL.md:641-644 SKILL.md:644-656 SKILL.md:656-661 SKILL.md:661-670 SKILL.md:670-673 SKILL.md:673-681 SKILL.md:681-688 SKILL.md:688-835 SKILL.md:835-838 SKILL.md:838-871 SKILL.md:871-942 SKILL.md:942-951 SKILL.md:951-954 SKILL.md:954-965 SKILL.md:965-968 SKILL.md:968-980 SKILL.md:980-983 SKILL.md:983-993 SKILL.md:91 SKILL.md:94-95 SKILL.md:121 SKILL.md:172 SKILL.md:195 SKILL.md:224-225 SKILL.md:228-229 SKILL.md:722 SKILL.md:725-726 SKILL.md:729-730 SKILL.md:742-743 SKILL.md:744 SKILL.md:784 SKILL.md:818 SKILL.md:825 SKILL.md:826 SKILL.md:853 SKILL.md:854 SKILL.md:949 SKILL.md:89-103 SKILL.md:115-123 SKILL.md:169-191 SKILL.md:222-239 SKILL.md:688-835 SKILL.md:838-871 SKILL.md:942-951
🌐 Network access (6)
📁 Filesystem access (6)
🔑 Env variables (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/dnyoussef-github-release-management/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/dnyoussef-github-release-management?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/dnyoussef-github-release-management?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-github-release-management/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/dnyoussef-github-release-management.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Claude Flow Team. (2026). github-release-management security audit report (audit version 8) [Author version 2.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-github-release-management/audits/8BibTeX citation
@techreport{claude-flow-team-dnyoussef-github-release-management-2026,
author = {Claude Flow Team},
title = {github-release-management security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/dnyoussef-github-release-management/audits/8},
note = {Author version 2.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-release-management security audit report (audit version 8)"
version: "2.0.0"
type: report
authors:
- name: "Claude Flow Team"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/dnyoussef-github-release-management/audits/8"
identifiers:
- type: other
value: "skillstore:dnyoussef-github-release-management:audit:8"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Higher Skillstore usage
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
ruvnet Recommended
ruvnet-github-release-management
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 10
Updated
2026-08-21
Claude Flow Team Current
dnyoussef-github-release-management
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 6
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
100
Maintainability
87
Content
70
Community
78
Spec Compliance
What You Can Build
Prepare a Standard Release
Create a release branch, update version files, generate notes, run validation, and open a release pull request.
Coordinate Enterprise Release Checks
Plan staged deployment, artifact generation, security scanning, approvals, monitoring, and rollback criteria.
Handle an Emergency Hotfix
Draft a hotfix workflow with critical tests, release creation, communication steps, and post-release monitoring.
Try These Prompts
Create a Release Plan
Plan a GitHub release for version [version]. Include version files, changelog tasks, validation checks, release notes, and approval steps.
Generate Release Notes
Use the merged pull requests and commits since [previous tag] to draft release notes for [version]. Highlight breaking changes and migration steps.
Build a CI Release Workflow
Design a GitHub Actions release workflow for [project]. Include tests, build artifacts, security checks, package publishing, and rollback safeguards.
Coordinate Multi-Repository Release
Plan a coordinated release across [repositories]. Include dependency order, compatibility checks, tags, artifacts, deployment windows, and rollback ownership.
Best Practices
- Require human approval before publishing packages, pushing images, or deploying production releases.
- Run release commands in isolated CI jobs with least-privilege tokens and protected environments.
- Review generated changelogs and release notes before using them in public releases.
Avoid
- Do not run publish, deploy, or rollback commands from unreviewed AI output.
- Do not store registry tokens in files that may enter caches, logs, or artifacts.
- Do not use emergency release paths to skip required security or compliance checks.
Frequently Asked Questions
Does this skill publish releases automatically?
It provides commands and workflow patterns. You should require approval before any publish or deployment command runs.
Which tools does it expect?
It expects GitHub CLI, git, Node.js, npm or yarn, and optionally Claude Flow or swarm tooling.
Can it generate changelogs?
Yes. It shows how to collect pull requests and commits, then draft categorized changelogs and migration notes.
Does it support monorepos?
Yes. It includes multi-package and multi-repository release coordination patterns.
How should secrets be handled?
Use CI secret stores, least-privilege tokens, protected environments, and cleanup steps for temporary credential files.
Is it safe for production releases?
It can support production workflows when commands, credentials, approvals, and rollback steps are reviewed by maintainers.
Developer Details
Author
Claude Flow TeamLicense
MIT
Author version
v2.0.0
Skillstore revision
r1
Repository
https://github.com/DNYoussef/ai-chrome-extension/tree/main/.claude/skills/github-release-managementRef
c579efd02184f1128d6741d16e6c8d951d7d4208
Maintenance freshness
7/18/2026
Usage
4 downloads · 191 views
File structure
📄 SKILL.md