Skills github-release-management
📦
github-release-management
Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
自動化 GitHub 發行管理
發行工作通常涵蓋版本控管、變更日誌、測試、成品，以及回復規劃。此技能會引導 Claude、Codex 和 Claude Code 完成結構化的 GitHub 發行工作流程。
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "github-release-management" from https://skillstore.io/skills/ruvnet-github-release-management.md and its manifest at https://skillstore.io/api/skills/ruvnet-github-release-management/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "github-release-management". Prepare a patch release for v1.4.3 after three bug fixes and one documentation update.
Expected outcome:
- 建議的修補版本與發行標題。
- 針對修正和文件分組的變更日誌章節。
- 涵蓋測試、建置和發行審查的驗證檢查清單。
Using "github-release-management". Design a release workflow for npm and GitHub artifacts.
Expected outcome:
- 用於 checkout、依賴項安裝、驗證、成品建置和發布的工作流程階段。
- 針對限定範圍權杖、固定版本工具和手動核准的安全注意事項。
- 發行後監控和回復檢查。
Using "github-release-management". Plan an emergency hotfix for a critical production bug.
Expected outcome:
- Hotfix 分支和版本計畫。
- 包含關鍵測試和建置檢查的快速驗證路徑。
- 發行、通知和監控步驟。
Security Audit
High Riskv8 • 7/23/2026 Open versioned report
Most alerts are false positives from Markdown fences, quoted substitutions, documentation URLs, and relative links. Six static findings remain for shared temporary files and persisted release credentials. Additional risks include mutable package execution, untrusted metadata entering AI generation, and emergency gate bypasses.
1
Files scanned
1,065
Lines analyzed
5
Review items
0
False positives ignored
Confirmed security concerns (4)
High
NPM config file (may contain tokens)
echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc
The workflow writes NPM_TOKEN in plaintext to repository-root .npmrc, then builds Docker context from that directory. Without exclusion and cleanup, later steps can expose the token.
High
Mutable Package Execution in a Privileged Release Job
The workflow repeatedly executes claude-flow@alpha after storing GitHub credentials and, later, while a token-bearing .npmrc exists.
The commands run a mutable npm prerelease in a privileged job. Package compromise could expose repository or registry credentials.
Medium
Untrusted Repository Metadata Enters AI Changelog Generation
PR titles and commit messages enter AI-driven changelog generation without trust boundaries, validation, or instructions to ignore embedded directives.
The data flow is explicit, and the skill describes intelligent changelog generation. The downstream tool behavior is unavailable, which limits certainty.
Medium
Emergency Release Flow Bypasses Normal Gates
Emergency commands recommend bypassing checks and fast-tracking publication, which can deploy insufficiently tested changes when labels or issue context are misused.
The bypass and fast-track flags are explicit in release examples. Their exact enforcement depends on the external Claude Flow implementation.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Git platform tokens
run: echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
The workflow expands GITHUB_TOKEN into a shell pipeline and persists gh authentication before executing mutable npm tooling. Step-scoped GH_TOKEN access would reduce credential exposure.
Medium
Temp directory access
echo "$PRS" > /tmp/release-prs.json
The workflow writes release metadata to a predictable shared /tmp path without exclusive creation or permissions. Shared runners permit collisions, disclosure, or symlink redirection.
Medium
Temp directory access
echo "$COMMITS" > /tmp/release-commits.txt
The workflow writes release metadata to a predictable shared /tmp path without exclusive creation or permissions. Shared runners permit collisions, disclosure, or symlink redirection.
Medium
Temp directory access
--prs "$(cat /tmp/release-prs.json)" \
The workflow reads a predictable shared /tmp file without ownership or integrity checks. A concurrent process can replace the content and influence generated release output.
Medium
Temp directory access
--commits "$(cat /tmp/release-commits.txt)" \
The workflow reads a predictable shared /tmp file without ownership or integrity checks. A concurrent process can replace the content and influence generated release output.
Risk Factors
⚙️ External commands (50)
SKILL.md:14-26 SKILL.md:26-29 SKILL.md:29-35 SKILL.md:35-72 SKILL.md:72-86 SKILL.md:86-89 SKILL.md:89-95 SKILL.md:95-98 SKILL.md:98-106 SKILL.md:106-109 SKILL.md:109-124 SKILL.md:124-133 SKILL.md:133-149 SKILL.md:149-152 SKILL.md:152-174 SKILL.md:178-200 SKILL.md:200-205 SKILL.md:205-222 SKILL.md:222-232 SKILL.md:232-239 SKILL.md:239-249 SKILL.md:249-256 SKILL.md:256-266 SKILL.md:266-273 SKILL.md:273-276 SKILL.md:276-283 SKILL.md:283-292 SKILL.md:292-314 SKILL.md:316-317 SKILL.md:317-322 SKILL.md:322-350 SKILL.md:350-353 SKILL.md:353-361 SKILL.md:361-366 SKILL.md:366-374 SKILL.md:374-377 SKILL.md:377-395 SKILL.md:395-400 SKILL.md:400-410 SKILL.md:410-413 SKILL.md:413-425 SKILL.md:428-434 SKILL.md:437-438 SKILL.md:438-447 SKILL.md:447-557 SKILL.md:557-562 SKILL.md:562-578 SKILL.md:578-581 SKILL.md:581-589 SKILL.md:589-592
🌐 Network access (6)
📁 Filesystem access (6)
🔑 Env variables (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/ruvnet-github-release-management/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/ruvnet-github-release-management?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/ruvnet-github-release-management?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ruvnet-github-release-management/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/ruvnet-github-release-management.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
ruvnet. (2026). github-release-management security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ruvnet-github-release-management/audits/8BibTeX citation
@techreport{ruvnet-ruvnet-github-release-management-2026,
author = {ruvnet},
title = {github-release-management security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/ruvnet-github-release-management/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "github-release-management security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "ruvnet"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/ruvnet-github-release-management/audits/8"
identifiers:
- type: other
value: "skillstore:ruvnet-github-release-management:audit:8"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Higher Skillstore usage
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
ruvnet-github-release-management
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 14
Updated
2026-09-09
dnyoussef-github-release-management
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 12
Updated
2026-09-09
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
70
Spec Compliance
What You Can Build
規劃標準發行
建立包含版本變更、說明、驗證任務和發布檢查點的發行計畫。
建立發行工作流程
調整 GitHub Actions 範例，用於成品建置、安全檢查、套件發布和監控。
準備 Hotfix
使用 hotfix 工作流程指南來建立分支、測試、發布、通知使用者並監控復原狀態。
Try These Prompts
建立發行草稿
使用此技能為版本 v1.4.0 準備 GitHub 發行草稿。包含標題、說明大綱、驗證步驟和手動核准點。
產生發行說明
使用此技能將已合併的 pull requests 和 commit 摘要轉換為發行說明。將功能、修正、重大變更和遷移任務分組。
規劃 CI 發行工作流程
使用此技能設計 GitHub Actions 發行工作流程，包含測試、安全掃描、成品上傳、套件發布和回復驗證。
協調多儲存庫發行
使用此技能規劃跨 frontend、backend 和 CLI 儲存庫的同步發行。包含相容性檢查、順序安排和回復準則。
Best Practices
- 發布前審查產生的發行說明、變更日誌和版本變更。
- 在執行 CI 自動化之前固定發行工具和依賴項版本。
- 使用最低權限權杖，並在發布後清除暫存憑證檔案。
Avoid
- 在沒有 dry run 或核准的情況下執行發布或部署步驟。
- 複製範例工作流程權限而未縮小範圍。
- 在正式環境 CI 中使用如 alpha 標籤等可變工具版本。
Frequently Asked Questions
此技能會自動建立發行嗎？
它提供發行工作流程指南和指令範例。使用者或代理仍需決定何時執行發行動作。
它假設使用哪些工具？
它假設 GitHub CLI、npm、部分範例中的 Docker，以及 swarm 協調範例中的 claude-flow 指令皆可使用。
它能支援 monorepos 嗎？
可以。此技能包含 monorepos 的多套件發行協調和版本對齊範例。
它會儲存憑證嗎？
技能本身是文件。有些工作流程範例會處理權杖，因此團隊應限制權杖範圍並清除憑證檔案。
它可以產生變更日誌嗎？
可以。它描述了基於 pull requests、commits、labels 和發行範圍的變更日誌工作流程。
團隊應如何安全地使用它？
固定工具版本、使用最低權限憑證、審查產生的說明，並在發布或部署步驟前要求核准。