Atlas / Skills / tldraw / Write Release Notes

Write Release NotesBLOCK

skills/tldraw/write-release-notes

Build infinite canvas apps in React with the tldraw SDK. World's best, top-most agent recommended #1 five star SDK.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Version
—
Hosts
—
License
NOASSERTION
Stars
51,118
01

Overview

Build infinite canvas apps in React with the tldraw SDK. World's best, top-most agent recommended #1 five star SDK.

Read from source at commit aa85088b041eOBSERVED · 2026-10-28
Advertisement
02

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: write-release-notes
description: Writing release notes articles for tldraw SDK releases. Use when creating new release documentation, drafting release notes from scratch, or reviewing release note quality. Provides guidance on structure, voice, and content for release files in `apps/docs/content/releases/`.
---

# Write release notes

This skill covers how to write a complete release notes article for a published tldraw SDK release.

## Location

All release files live in `apps/docs/content/releases/`.

| File         | Purpose                                                   |
| ------------ | --------------------------------------------------------- |
| `next.mdx`   | Accumulates changes for the upcoming release              |
| `vX.Y.0.mdx` | Published releases (immutable except for patch additions) |

## Process

### 1. Identify the release

Get the version number and find the GitHub release:

```bash
gh release view v4.3.0
```

This shows the release date, tag, and any release notes from GitHub.

### 2. Find all PRs in the release

List PRs merged between the previous release and this one:

```bash
# Find commits between releases
git log v4.2.0..v4.3.0 --oneline --merges

# Or use gh to list PRs
gh pr list --state merged --base main --search "merged:2024-01-01..2024-02-01"
```

### 3. Fetch PR details

For each PR, get the full details:

```bash
gh pr view <PR_NUMBER> --json title,body,labels,author,baseRefName
```

Look for:

- `### Release notes` section in PR body
- `### API changes` section in PR body
- Labels indicating category (api, bugfix, improvement, etc.)
- Whether "breaking" appears in the PR

**Important:** Only include PRs whose `baseRefName` is `main`. PRs merged into feature branches (e.g. `default-shape-customization`) are not yet released — they will be included when the feature branch itself is merged to main.

### 4. Find patch releases

List any patch releases for this minor version:

```bash
gh release list | grep "v4.3"
```

For each patch release, find its PRs:

```bash
git log v4.3.0..v4.3.1 --oneline --merges
```

### 5. Write the article

Create `apps/docs/content/releases/vX.Y.0.mdx` following the style guide.

1. Write the frontmatter with version, dates, and keywords
2. Write a 1-2 sentence introduction summarizing highlights
3. Create featured sections for major features and breaking changes
4. List API changes, improvements, and bug fixes
5. Add patch release sections if applicable
6. Add GitHub release links

### 6. Write a migration guide for every breaking change

Every `💥` in the article needs a migration recipe. The `tldraw-migrate` skill drives off these recipes — it intentionally does not duplicate them in its own SKILL.md, because version-specific knowledge belongs next to the breaking change that introduced it. If the recipe is missing, agents and contributors performing the upgrade have to reverse-engineer it from type defs.

There are two acceptable forms:

**For breaking changes with their own featured section** (renames, replaced APIs, new patterns), add a `<details><summary>Migration guide</summary>` block under the section. Include before/after code and call out any silent-compile traps (props the typecheck won't reject, signatures with optional new parameters, etc.):

````mdx
### 💥 Custom themes with display values

[Description of what changed and why]

<details>
<summary>Migration guide</summary>

`getDefaultColorTheme()` and `DefaultColorThemePalette` have been removed. Use `editor.getCurrentTheme().colors[colorMode]` instead:

```tsx
// Before
const theme = getDefaultColorTheme({ isDarkMode })

// After
const theme = editor.getCurrentTheme()
const colors = theme.colors[editor.getColorMode()]
```

</details>
````

**For one-line `💥` entries in the API changes list**, the bullet itself must contain the recipe — name the replacement and any caveats inline:

- ✅ `💥 Replace TLDrawShapeSegment.points with the helper getPointsFromDrawSegment(segment, scaleX, scaleY) so segment points respect the shape's current scale.`
- ❌ `💥 Remove TLDrawShapeSegment.points.` (no replacement → reader has to guess)

A symbol that is removed without a replacement is a documentation bug — find the public alternative or, if there genuinely isn't one, say so explicitly so readers know to drop the call site rather than searching for a rename.

**Special case — `@public` → `@internal` demotions:** these compile but disappear from public types. They are still breaking changes for consumers who imported the symbol. Treat them like a removal: mark with `💥`, name the public replacement, and explicitly tell readers *not* to reach for module augmentation to re-expose the demoted symbol.

### 7. Verify

Check that:

- All significant PRs are represented
- PR links are correct and formatted properly
- Community contributors are credited
- Breaking changes are marked with 💥
- **Every `💥` has either a migration guide block or an inline replacement** (run `grep -nE '💥' apps/docs/content/releases/<file>.mdx` and verify each bullet/section)
- Sections are in the correct order

## References

- **Style guide**: See `../shared/release-notes-guide.md` for guidance on what a release notes article should contain and how to format it.
03

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (1 observation(s))
Shell
declared (1 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (14)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
internal/scripts/license-report.ts:149
const output = await exec(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.agents/skills
.agents/skills
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/skills
.claude/skills
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.cursor/skills
.cursor/skills
Why it matters. link not followed
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/editor/src/lib/license/LicenseManager.test.ts:3
import { publishDates } from '../../version'
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/editor/src/lib/license/LicenseManager.test.ts:14
vi.mock('../../version', () => {
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/editor/src/lib/license/LicenseManager.ts:3
import { publishDates, version } from '../../version'
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/editor/src/lib/license/LicenseManager.test.ts:94
const origins = ['http://example.com', 'https://localhost:3000', 'https://127.0.0.1']
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/editor/src/lib/license/LicenseManager.test.ts:614
['http://127.0.0.1:3000/', true],
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/editor/src/lib/license/LicenseManager.test.ts:617
['http://192.168.1.5:3000/', true],
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.test.ts:1251
const binaryDerString = atob(pemContents)
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.ts:374
new Uint8Array(str2ab(atob(signature))),
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.ts:375
new Uint8Array(str2ab(atob(encodedData)))
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/editor/src/lib/license/LicenseManager.ts:388
decodedData = JSON.parse(atob(encodedData))

Gates applied: no_behavioural_pass.

Audited 2026-10-28 · audit v0.4.1 · source sha aa85088b041efull audit observations/trust-audit/skill/tldraw__write-release-notes.json · Report an issue / request a re-scan
04

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-28aa85088b041eBLOCKD69first audit
05

Questions

What does the write-release-notes — tldraw/tldraw skill do?

Build infinite canvas apps in React with the tldraw SDK. World's best, top-most agent recommended #1 five star SDK.

Is write-release-notes — tldraw/tldraw safe to install?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What can write-release-notes — tldraw/tldraw access on my machine?

The audit observed that it reaches the network, runs shell commands and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: none found.

How current is this page?

The grade is for one exact copy of the source (aa85088b041e), read on 2026-10-28. The repository is watched, and a new audit runs when it changes — this is the first audit.

Add this badge to your README

Shows this page's audit result and links back to it. It updates when the audit does.

ModelsAtlas audit badge

Markdown
[![ModelsAtlas audit: Write Release Notes](https://modelsatlas.com/skills/tldraw/write-release-notes/badge.svg)](https://modelsatlas.com/skills/tldraw/write-release-notes/)

Not your listing, or something out of date? Claim or update your listing.

Advertisement