Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

Agent skill · Audited from source

Changelog Generation

skill · echoVic/boss-skillMIT licenceAudited 15 Oct 2026 · source 0317d4cb4f54

★ 542pushed 4 days agoversion 1.0.0
✓SAFEGrade B · 89/100 · 15 Oct 2026 · 0317d4c
542repo stars · whole echoVic/boss-skill

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 0317d4cb4f54 and found no filesystem, network or shell access and no hard-coded secrets. What it does: 自动生成 CHANGELOG,基于 git 提交历史和 pipeline 产物信息,遵循 Conventional Commits 和 Keep a Changelog 规范

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Changelog Generation (echoVic/boss-skill)”. Retrieved 15 Oct 2026. https://modelsatlas.com/skills/echovic/changelog-generation

Trust audit

Audit 0.4.1 · source read 15 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha 0317d4cb4f54 · 15 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • PublisherechoVic GitHub userOwner of the repository this skill is read from
  • Source folderechoVic/boss-skill/skill/skills/devops/changelog-generationThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict0317d4cb4f54A new audit runs when the source changes
  • Repository statusNot archivedLast push 4 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: 自动生成 CHANGELOG,基于 git 提交历史和 pipeline 产物信息,遵循 Conventional Commits 和 Keep a Changelog 规范

---
name: devops/changelog-generation
description: 自动生成 CHANGELOG,基于 git 提交历史和 pipeline 产物信息,遵循 Conventional Commits 和 Keep a Changelog 规范
version: 1.0.0
agent: devops
type: workflow
user-invocable: false
agent-invocable: true
dependencies:
  - devops/deployment-process
triggers:
  - 部署成功完成后
  - 需要生成版本变更日志时
  - 发布新版本时
metadata:
  internal: true
---

# CHANGELOG 自动生成

## 适用场景

在部署成功完成后自动生成或追加 CHANGELOG,记录本次发布的所有变更。适用于:
- 部署完成后的发布记录
- 版本发布前的变更汇总
- 对外发布说明的自动生成

## 核心方法

### 步骤 1:信息收集

1. **Git 历史解析**:
   ```bash
   # 获取从上次 tag 到 HEAD 的所有提交
   git log $(git describe --tags --abbrev=0 2>/dev/null || git rev-list --max-parents=0 HEAD)..HEAD --pretty=format:"%H|%s|%an|%ai"
   ```
   - 如果没有 tag,取最近 50 条提交
   - 解析 Conventional Commits 格式:`type(scope): description`

2. **Pipeline 产物读取**:
   - `.boss/<feature>/prd.md` → 功能描述和用户价值
   - `.boss/<feature>/deploy-report.md` → 部署环境和版本信息
   - `.boss/<feature>/tasks.md` → 完成的任务列表

3. **版本号确定**:
   - 优先使用 `package.json` 中的 version
   - 其次使用最新 git tag
   - 如无法确定,使用日期格式 `YYYY.MM.DD`

### 步骤 2:变更分类

按 Conventional Commits 规范分类:

| 类型 | CHANGELOG 分类 | 说明 |
|------|---------------|------|
| `feat` | **Added** | 新增功能 |
| `fix` | **Fixed** | 修复问题 |
| `perf` | **Performance** | 性能优化 |
| `refactor` | **Changed** | 重构(非功能变更) |
| `docs` | **Documentation** | 文档更新 |
| `style` | _(不记录)_ | 代码格式 |
| `test` | _(不记录)_ | 测试相关 |
| `chore` | _(不记录)_ | 构建/工具变更 |
| `BREAKING CHANGE` | **⚠️ Breaking Changes** | 破坏性变更(始终置顶) |

对于非 Conventional Commits 格式的提交:
- 根据关键词推断分类(add/new → Added, fix/bug → Fixed, update/change → Changed)
- 无法分类的归入 **Changed**

### 步骤 3:内容生成

#### 格式规范(Keep a Changelog)

```markdown
## [版本号] - YYYY-MM-DD

### ⚠️ Breaking Changes
- 破坏性变更描述 ([commit-hash])

### Added
- 新功能描述(来自 PRD 的用户价值说明) ([commit-hash])

### Changed
- 变更描述 ([commit-hash])

### Fixed
- 修复描述 ([commit-hash])

### Performance
- 优化描述 ([commit-hash])
```

#### 生成规则

1. 每条记录包含:清晰描述 + commit short hash 引用
2. 如有 PRD,用 PRD 中的功能描述替代 commit message(更面向用户)
3. Breaking Changes 始终置顶并用 ⚠️ 标记
4. 同一 scope 的多条提交合并为一条记录
5. 最多展示 20 条变更,超出部分汇总为 "及其他 N 项更新"

### 步骤 4:输出写入

**两种输出模式:**

1. **产物模式**(默认):写入 `.boss/<feature>/changelog.md`
2. **追加模式**:如项目根目录已有 `CHANGELOG.md`,将新版本内容追加到文件顶部(在 `# Changelog` 标题之后)

**追加逻辑:**
```
读取现有 CHANGELOG.md
→ 找到第一个 ## [version] 行
→ 在其前面插入新版本内容
→ 写回文件
```

如果项目无 `CHANGELOG.md`,则创建包含标准头部的新文件:
```markdown
# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/).

## [版本号] - 日期
...
```

## 输出要求

1. 产物文件 `.boss/<feature>/changelog.md` 必须生成
2. 如项目根存在 `CHANGELOG.md`,同步更新
3. 变更内容必须准确反映实际代码变更
4. 面向用户的描述优先于面向开发者的 commit message

Excerpt, first 2,665 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 0317d4c

Download folder ↗
git clone https://github.com/echoVic/boss-skill
git -C boss-skill checkout 0317d4cb4f54

The author documents no install command, so this uses the repository directly. Our verdict covers commit 0317d4cb4f54 only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source 0317d4cb4f54

Questions about Changelog Generation

What does the Changelog Generation skill do?
Boss Skill - BMAD 全自动研发流水线(多 Agent 编排)
Is Changelog Generation safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Changelog Generation access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (0317d4cb4f54), read on 2026-10-15. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.