Skills product-changelog

📦

product-changelog

Name: product-changelog
Author: inference-sh-9

Content revision r1 Critical ⚙️ External commands🌐 Network access

Write Clear Product Changelogs

Release notes often become developer logs that users skip. This skill helps turn product changes into clear changelogs, announcements, visuals, and distribution plans.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "product-changelog" from https://skillstore.io/skills/inference-sh-9-product-changelog.md and its manifest at https://skillstore.io/api/skills/inference-sh-9-product-changelog/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/inference-sh-9-product-changelog.md Signed manifest GET /api/skills/inference-sh-9-product-changelog/manifest Signed lockfile GET /api/skills/inference-sh-9-product-changelog/lockfile

Test it

Using "product-changelog". Developer note: Added batch export backend and raised CSV export limit to 10,000 rows.

Expected outcome:

New: Bulk Export for Reports. You can now export up to 10,000 rows from any report view.

Using "product-changelog". Developer note: Fixed timezone bug in date picker and optimized dashboard queries.

Expected outcome:

Improved: Dashboards now load faster when filtering large datasets.
Fixed: Date pickers now show the correct timezone for every workspace.

Using "product-changelog". API v1 will stop working on March 15, 2026.

Expected outcome:

Breaking: API v1 ends on March 15, 2026. Move integrations to API v2 before that date.

Security Audit

Critical

v4 • 7/5/2026 Open versioned report

Most Ruby backtick findings are false positives caused by Markdown code fences, not executable Ruby or shell interpolation. The install command on SKILL.md line 14 is confirmed critical because it pipes a remote script directly to sh. The skill also grants broad infsh command access, so users may send product data to external services.

Files scanned

269

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Critical

SKILL.md:14

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh && infsh login

The quick start instructs users to run curl -fsSL https://cli.inference.sh | sh. Piping downloaded content directly to a shell is a critical supply-chain risk.

High

SKILL.md:4 SKILL.md:149-174

Broad External CLI Permission

The front matter permits Bash(infsh *), and the skill shows infsh app run commands for browser and image services. This can send app URLs, screenshots, or product images to external inference.sh services.

The allowed tool pattern and infsh app run examples are explicit. The exact data exposure depends on user inputs, so confidence is high but not absolute.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical

SKILL.md:14

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh && infsh login

The command downloads a remote script from cli.inference.sh and pipes it directly to sh. This creates unaudited remote code execution during installation.

Risk Factors

Detected Patterns

Pipe to shell pattern

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/inference-sh-9-product-changelog/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/inference-sh-9-product-changelog/security.svg)](https://skillstore.io/skills/inference-sh-9-product-changelog?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/inference-sh-9-product-changelog?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/inference-sh-9-product-changelog/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/inference-sh-9-product-changelog.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

inference-sh-9. (2026). product-changelog security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/inference-sh-9-product-changelog/audits/4

BibTeX citation

@techreport{inference-sh-9-inference-sh-9-product-changelog-2026,
  author = {inference-sh-9},
  title = {product-changelog security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/inference-sh-9-product-changelog/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "product-changelog security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "inference-sh-9"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/inference-sh-9-product-changelog/audits/4"
identifiers:
  - type: other
    value: "skillstore:inference-sh-9-product-changelog:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Prepare Weekly Release Notes

Turn shipped work into dated changelog entries with clear categories and user benefits.

Announce Feature Launches

Create concise release copy for in-app messages, email updates, and launch posts.

Document API Changes

Write breaking-change notices with migration steps, timelines, and support links.

Try These Prompts

Draft a Simple Changelog Entry

Write one user-facing changelog entry for this change: [describe the change]. Include category, title, benefit, and one sentence.

Rewrite Developer Notes

Rewrite these developer notes as release notes for customers: [paste notes]. Group them as New, Improved, Fixed, Removed, or Security.

Plan a Launch Announcement

Create a launch announcement plan for [feature]. Include changelog copy, in-app copy, email copy, social copy, and suggested visuals.

Create a Breaking Change Notice

Write a breaking-change release note for [change]. Include impact, affected users, migration steps, timeline, and support guidance.

Best Practices

Lead with what users can do now.
Group changes by category and date.
Add screenshots or short demos for visible product changes.

Avoid

Do not publish commit logs as changelogs.
Do not use vague phrases like bug fixes and improvements.
Do not bury breaking changes below routine updates.

Frequently Asked Questions

Can this skill write release notes from engineering notes?

Yes. Provide the shipped changes, user impact, and release date for better results.

Does it choose version numbers?

It explains semantic and date-based versioning, then suggests a label from your release context.

Can it create visual changelog ideas?

Yes. It suggests screenshots, before-after views, callouts, charts, banners, or short demos.

Does it publish changelogs automatically?

No. It helps draft and structure content, but publishing stays under user control.

Is it useful for API releases?

Yes. It includes guidance for versioned APIs, deprecation notices, migration steps, and timelines.

What tools can use this skill?

The report lists support for Claude, Codex, and Claude Code.

Developer Details

Author

inference-sh-9

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/inference-sh-9/skills/tree/main/skills/product-changelog/

Ref

a25199bc7d6b82598536822d1738eb5d5f54025b

Maintenance freshness

7/18/2026

Usage

4 downloads · 185 views

File structure

📄 SKILL.md