Release Manager

Release Manager

This skill largely does what it says (generate changelogs, recommend version bumps, produce release plans), but there are some red flags to check before installing: - Verify dependencies: open the Python files (release_planner.py especially) and confirm whether they import non-standard packages (e.g., requests). If so, the README claiming "no external dependencies" is incorrect — install those packages in a controlled environment (virtualenv) before running. - Network access and credentials: the release planner calls the GitHub API in examples. Decide whether you will run this against public repos only or private ones. For private repos or to avoid rate limits you may need to provide a GitHub token; the skill does not declare or request one, so plan how you'll supply credentials safely (CI secrets, not pasted into chat). - Review for subprocess/network effects: inspect the code for any subprocess, os.system, or exec usage that would run shell commands. The sample rollback JSON contains commands like kubectl, curl, and redis-cli — these are examples, but confirm scripts only generate commands rather than executing them automatically. - Run in a sandbox first: execute the scripts on a test checkout or sample data (assets/) to observe behavior and network calls before pointing them at production repositories or granting credentials. - Check provenance: the source/owner is unknown. Prefer tools from a known maintainer or fork and audit the code; if you will use this in CI, pin the repository and add dependency and security reviews. If you want, I can scan the actual Python files for network calls, subprocess usage, and external imports and produce a short summary of risky lines to review next.

Type: OpenClaw Skill Name: release-manager Version: 2.1.1 The 'release-manager' skill bundle is a comprehensive set of DevOps tools for automating changelog generation, version bumping, and release planning. Analysis of the Python scripts (changelog_generator.py, version_bumper.py, and release_planner.py) reveals they rely exclusively on the Python standard library for string parsing and data processing. There is no evidence of malicious execution (e.g., eval, os.system), data exfiltration, or prompt injection. While the scripts generate shell commands as output for the user, they do not execute them directly, and the documentation in SKILL.md and README.md is strictly aligned with the stated engineering purpose.