Audit Release

What it does

When your agent uses it

• Tasks that involve Feature launches and release readiness

Example prompts

• “/audit-release”

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

1. 1先执行 audit-common 的 G0~G5，确认审查范围、文件完整性、一致性与链接基础质量。
2. 2冻结发布审查范围：目标版本、发布包、registry、关联 changelog、关联需求/bug，并用 tag/registry/release note/public docs/实际消费者建立发布权威证据。
3. 3逐项执行 RL-1~RL-10；缺证据时标为 ⚠️待验证，不得写成通过。
4. 4对照 release-verification：执行链缺失写 RL-7；审查风险缺失写 RL-1~RL-6/RL-8~RL-10；RL-9 触发 PublisherCredentialTopologyGate 时，复制 workflow 或普通 dry-run 不能替代…
5. 5输出 findings-first 报告；无问题时仍列出通过证据和残余风险。

What it can do on your machine

Read from SKILL.md and the folder at commit 1dd4525. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • npm

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md. Its commands use npm, which can reach the network depending on how they are called.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Audit Release loads about 1k tokens when it runs. Until then it costs about 64 tokens; SKILL.md has 200 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~64

When it runs · the whole SKILL.md, loaded when a task matches

~1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:38

  y 追加 `ScopedRegistryResolutionGate`，核对 `.npmrc` scope 路由、命令级 override、发布身份、secret scope/access/inheritance、workflow perm

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from devcodex-labs/devcodex at commit 1dd4525, republished under its AGPL-3.0 licence (© devcodex-labs). 200 words, ~1,030 tokens.

name

audit-release

description

发布前审查维度 — 审查 release readiness、发布说明质量、兼容性/迁移风险、package/plugin 元数据、文档/Profile/website 同步、回滚策略、registry/tag 风险和发布后验收；用于用户要求发版前 review、release pre-review、publish/tag 前风险审查或 audit 工作流识别为发布准备审查时。不同于 release-verification，本 Skill 负责审查判断，不执行真实发布动作。

## Release Audit

| 维度 | 状态 | 证据 | 结论/动作 |
|------|------|------|-----------|
| RL-1 | ✅/⚠️/❌/N/A | | |
| RL-2 | ✅/⚠️/❌/N/A | | |
| RL-3 | ✅/⚠️/❌/N/A | ReleaseAuthorityBeforeCompatibilityGate | |
| RL-4 | ✅/⚠️/❌/N/A | package completeness gate | |
| RL-5 | ✅/⚠️/❌/N/A | pack/install evidence | |
| RL-6 | ✅/⚠️/❌/N/A | README/website/Profile；InteractiveSemanticProbe 或 N/A | |
| RL-7 | ✅/⚠️/❌/N/A | R0~R7 + candidate freeze/generation + budget/reuse decision + staged candidate + command/shell/cwd/exitCode | |
| RL-8 | ✅/⚠️/❌/N/A | rollback plan | |
| RL-9 | ✅/⚠️/❌/N/A | registry/token boundary + PublisherCredentialTopologyGate（无 secret value） | |
| RL-10 | ✅/⚠️/❌/N/A | post-release acceptance | |

© devcodex-labs, AGPL-3.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in content/skills/audit-release of devcodex-labs/devcodex.

• SKILL.md
• intent.json

Open the folder on GitHubat commit 1dd4525