技能 github-release-management
📦

github-release-management

v2.0.0 内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量

管理 GitHub Releases

发布工作通常涵盖版本控制、测试、变更日志、构件和部署检查。此技能为 Claude、Codex 和 Claude Code 提供结构化的发布工作流。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "github-release-management" from https://skillstore.io/skills/dnyoussef-github-release-management.md and its manifest at https://skillstore.io/api/skills/dnyoussef-github-release-management/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/dnyoussef-github-release-management.md 已签名 manifest GET /api/skills/dnyoussef-github-release-management/manifest 已签名 lockfile GET /api/skills/dnyoussef-github-release-management/lockfile

测试它

正在使用“github-release-management”。 为 Node 包规划 release v2.0.0。

预期结果:

一份发布检查清单，涵盖分支创建、版本提升、变更日志草稿、测试和构建验证、发布拉取请求、npm publish 审批以及监控。

正在使用“github-release-management”。 根据已合并的拉取请求创建发布说明。

预期结果:

按功能、修复、破坏性变更、贡献者、迁移指导和已知问题分类的发布说明。

正在使用“github-release-management”。 准备紧急热修复流程。

预期结果:

一份聚焦的热修复计划，包含分支来源、cherry-pick 步骤、关键测试、审批关卡、发布步骤、公告和回滚检查。

安全审计

高风险
v8 • 2026/7/5 打开版本化报告

The skill is a Markdown release-automation guide with many static false positives from code fences. Real risks remain in shell command substitutions, predictable /tmp files, GitHub and npm token handling, and credentialed publish/deploy workflows.

1
已扫描文件
1,082
分析行数
24
复核项
0
已忽略误报

已确认安全问题 (3)

高
SKILL.md:795
NPM config file (may contain tokens)
echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc
The workflow writes secrets.NPM_TOKEN into .npmrc before publishing. Credential files can persist in workspaces, caches, or artifacts if cleanup is not enforced.
高
SKILL.md:792-800
Credentialed Package and Image Publication
The release workflow includes npm publish and Docker image push steps after writing registry credentials. If run without approval, the skill can cause credentialed package and image releases.
The cited workflow directly publishes to npm and pushes Docker images using CI context. This is a clear high-impact release action, even though it is aligned with the skill purpose.
中
SKILL.md:430-448SKILL.md:864-870
Fast-Track Emergency Release Path
The emergency hotfix guidance creates releases and publishes hotfix packages with fast-track flags. Without an approval gate, this can ship unreviewed changes during an incident.
The cited sections explicitly create hotfix releases, publish packages, and call an emergency-release command with --fast-track. The risk is operational misuse rather than hidden malicious code.
能力复核项 (24)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高
SKILL.md:716
Git platform tokens
run: echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
The workflow pipes secrets.GITHUB_TOKEN into gh auth login and grants write-capable release operations. This is expected for CI, but it materially expands the impact of misuse.
中
SKILL.md:91
Shell command substitution
LAST_TAG=$(gh release list --limit 1 --json tagName -q '.[0].tagName')
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:94-95
Shell command substitution
CHANGELOG=$(gh api repos/:owner/:repo/compare/${LAST_TAG}...HEAD \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:121
Shell command substitution
gh release create $(npm pkg get version) \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:172
Shell command substitution
Bash("gh api repos/:owner/:repo/git/refs --method POST -f ref='refs/heads/release/v2.0.0' -f sha=$(g
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:195
Shell command substitution
--body "$(cat RELEASE_NOTES.md)"`)
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:224-225
Shell command substitution
PRS=$(gh pr list --state merged --base main --json number,title,labels,author,mergedAt \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:228-229
Shell command substitution
COMMITS=$(gh api repos/:owner/:repo/compare/v1.0.0...HEAD \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:722
Shell command substitution
PREV_TAG=$(gh release list --limit 2 --json tagName -q '.[1].tagName')
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:725-726
Shell command substitution
PRS=$(gh pr list --state merged --base main --json number,title,labels,author,mergedAt \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:729-730
Shell command substitution
COMMITS=$(gh api repos/${{ github.repository }}/compare/${PREV_TAG}...HEAD \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:742-743
Shell command substitution
CHANGELOG=$(npx claude-flow@alpha github changelog \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:744
Shell command substitution
--commits "$(cat /tmp/release-commits.txt)" \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:784
Shell command substitution
--notes "$(cat RELEASE_CHANGELOG.md)" \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:818
Shell command substitution
--body "$(cat RELEASE_CHANGELOG.md)" \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:825
Shell command substitution
-f body="$(cat RELEASE_CHANGELOG.md)" \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:826
Shell command substitution
-f category_id="$(gh api repos/${{ github.repository }}/discussions/categories --jq '.[] | select(.s
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:853
Shell command substitution
LAST_STABLE=$(gh release list --limit 1 --json tagName -q '.[0].tagName')
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:854
Shell command substitution
HOTFIX_VERSION=$(echo $LAST_STABLE | awk -F. '{print $1"."$2"."$3+1}')
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:949
Shell command substitution
docker run --rm -v $(pwd):/app node:20 \
The skill instructs shell command substitution while running release automation commands. This is legitimate for releases, but it executes local or networked CLI commands with derived values.
中
SKILL.md:736
Temp directory access
echo "$PRS" > /tmp/release-prs.json
The workflow writes release metadata to predictable /tmp paths and reads it back later. In shared or reused runners this can cause clobbering or unintended disclosure.
中
SKILL.md:737
Temp directory access
echo "$COMMITS" > /tmp/release-commits.txt
The workflow writes release metadata to predictable /tmp paths and reads it back later. In shared or reused runners this can cause clobbering or unintended disclosure.
中
SKILL.md:743
Temp directory access
--prs "$(cat /tmp/release-prs.json)" \
The workflow writes release metadata to predictable /tmp paths and reads it back later. In shared or reused runners this can cause clobbering or unintended disclosure.
中
SKILL.md:744
Temp directory access
--commits "$(cat /tmp/release-commits.txt)" \
The workflow writes release metadata to predictable /tmp paths and reads it back later. In shared or reused runners this can cause clobbering or unintended disclosure.

风险因素

⚙️ 外部命令 (99)
SKILL.md:31-43 SKILL.md:43-46 SKILL.md:46-52 SKILL.md:52-89 SKILL.md:89-103 SKILL.md:103-106 SKILL.md:106-112 SKILL.md:112-115 SKILL.md:115-123 SKILL.md:123-126 SKILL.md:126-141 SKILL.md:141-150 SKILL.md:150-166 SKILL.md:166-169 SKILL.md:169-191 SKILL.md:195-217 SKILL.md:217-222 SKILL.md:222-239 SKILL.md:239-249 SKILL.md:249-256 SKILL.md:256-266 SKILL.md:266-273 SKILL.md:273-283 SKILL.md:283-290 SKILL.md:290-293 SKILL.md:293-300 SKILL.md:300-309 SKILL.md:309-331 SKILL.md:333-334 SKILL.md:334-339 SKILL.md:339-367 SKILL.md:367-370 SKILL.md:370-378 SKILL.md:378-383 SKILL.md:383-391 SKILL.md:391-394 SKILL.md:394-412 SKILL.md:412-417 SKILL.md:417-427 SKILL.md:427-430 SKILL.md:430-442 SKILL.md:445-451 SKILL.md:454-455 SKILL.md:455-464 SKILL.md:464-574 SKILL.md:574-579 SKILL.md:579-595 SKILL.md:595-598 SKILL.md:598-606 SKILL.md:606-609 SKILL.md:609-617 SKILL.md:617-622 SKILL.md:622-630 SKILL.md:630-633 SKILL.md:633-641 SKILL.md:641-644 SKILL.md:644-656 SKILL.md:656-661 SKILL.md:661-670 SKILL.md:670-673 SKILL.md:673-681 SKILL.md:681-688 SKILL.md:688-835 SKILL.md:835-838 SKILL.md:838-871 SKILL.md:871-942 SKILL.md:942-951 SKILL.md:951-954 SKILL.md:954-965 SKILL.md:965-968 SKILL.md:968-980 SKILL.md:980-983 SKILL.md:983-993 SKILL.md:91 SKILL.md:94-95 SKILL.md:121 SKILL.md:172 SKILL.md:195 SKILL.md:224-225 SKILL.md:228-229 SKILL.md:722 SKILL.md:725-726 SKILL.md:729-730 SKILL.md:742-743 SKILL.md:744 SKILL.md:784 SKILL.md:818 SKILL.md:825 SKILL.md:826 SKILL.md:853 SKILL.md:854 SKILL.md:949 SKILL.md:89-103 SKILL.md:115-123 SKILL.md:169-191 SKILL.md:222-239 SKILL.md:688-835 SKILL.md:838-871 SKILL.md:942-951
🌐 网络访问 (6)
SKILL.md:498 SKILL.md:1023 SKILL.md:1024 SKILL.md:1035 SKILL.md:1036 SKILL.md:1037
📁 文件系统访问 (6)
SKILL.md:1025 SKILL.md:1026 SKILL.md:736 SKILL.md:737 SKILL.md:743 SKILL.md:744
🔑 环境变量 (1)
SKILL.md:716
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/dnyoussef-github-release-management/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/dnyoussef-github-release-management/security.svg)](https://skillstore.io/skills/dnyoussef-github-release-management?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/dnyoussef-github-release-management?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-github-release-management/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/dnyoussef-github-release-management.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

Claude Flow Team. (2026). github-release-management security audit report (audit version 8) [Author version 2.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-github-release-management/audits/8

BibTeX 引用

@techreport{claude-flow-team-dnyoussef-github-release-management-2026, author = {Claude Flow Team}, title = {github-release-management security audit report (audit version 8)}, institution = {Skillstore}, year = {2026}, number = {8}, url = {https://skillstore.io/skills/dnyoussef-github-release-management/audits/8}, note = {Author version 2.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "github-release-management security audit report (audit version 8)" version: "2.0.0" type: report authors: - name: "Claude Flow Team" date-released: "2026-07-05" url: "https://skillstore.io/skills/dnyoussef-github-release-management/audits/8" identifiers: - type: other value: "skillstore:dnyoussef-github-release-management:audit:8" description: "Skillstore immutable audit report identifier"

比较变体

2 个可安装变体

每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。

为什么此变体排名第一

Skillstore 使用量更高
ruvnet 推荐

ruvnet-github-release-management

Skillstore 评分 38
证据置信度 中
Skillstore 使用量 11
已更新

2026-09-09

Claude Flow Team 当前

dnyoussef-github-release-management

Skillstore 评分 38
证据置信度 中
Skillstore 使用量 8
已更新

2026-09-09

Skillstore 评分

评分依据 证据置信度: 中
55
架构
100
可维护性
87
内容
70
社区
78
规范符合性

你能构建什么

准备标准发布

创建发布分支、更新版本文件、生成说明、运行验证，并打开发布拉取请求。

协调企业发布检查

规划分阶段部署、构件生成、安全扫描、审批、监控和回滚标准。

处理紧急热修复

起草包含关键测试、发布创建、沟通步骤和发布后监控的热修复工作流。

试试这些提示

创建发布计划 
为版本 [version] 规划 GitHub 发布。包括版本文件、变更日志任务、验证检查、发布说明和审批步骤。
生成发布说明 
使用自 [previous tag] 以来已合并的拉取请求和提交，为 [version] 起草发布说明。突出显示破坏性变更和迁移步骤。
构建 CI 发布工作流 
为 [project] 设计 GitHub Actions 发布工作流。包括测试、构建构件、安全检查、包发布和回滚保护措施。
协调多仓库发布 
规划跨 [repositories] 的协调发布。包括依赖顺序、兼容性检查、标签、构件、部署窗口和回滚责任归属。

最佳实践

  • 在发布包、推送镜像或部署生产版本之前，要求人工批准。
  • 在隔离的 CI 作业中使用最小权限令牌和受保护环境运行发布命令。
  • 在公开发布中使用生成的变更日志和发布说明之前进行审查。

避免

  • 不要从未经审查的 AI 输出中运行 publish、deploy 或 rollback 命令。
  • 不要将 registry 令牌存储在可能进入缓存、日志或构件的文件中。
  • 不要使用紧急发布路径来跳过必需的安全或合规检查。

常见问题

此技能会自动发布版本吗？
它提供命令和工作流模式。你应该要求在任何发布或部署命令运行之前进行审批。
它需要哪些工具？
它需要 GitHub CLI、git、Node.js、npm 或 yarn，并可选使用 Claude Flow 或 swarm 工具。
它能生成变更日志吗？
可以。它展示了如何收集拉取请求和提交，然后起草分类的变更日志和迁移说明。
它支持 monorepos 吗？
可以。它包括多包和多仓库发布协调模式。
应如何处理密钥？
使用 CI 密钥存储、最小权限令牌、受保护环境，以及用于临时凭据文件的清理步骤。
它对生产发布安全吗？
当命令、凭据、审批和回滚步骤由维护者审查后，它可以支持生产工作流。

开发者详情

许可证

MIT

作者版本

v2.0.0

Skillstore 修订

r1

仓库

https://github.com/DNYoussef/ai-chrome-extension/tree/main/.claude/skills/github-release-management

引用

c579efd02184f1128d6741d16e6c8d951d7d4208

维护新鲜度

2026/7/26

使用量

4 次下载 · 191 次浏览

文件结构

📄 SKILL.md

Claude Flow Team 的更多技能

相关技能

查看全部