Professional changelog and release notes generator for client-facing software releases and updates. Automatically parse git commit history using conventional...
Security Analysis
medium confidenceThe skill appears to be a self-contained, local changelog/release-notes CLI that requires only python3 and git and stores data under ~/.nex-changelog; its declared purpose matches the code and runtime instructions, with no network calls or secret access requested.
Name/description (changelog & release notes) align with required binaries (python3, git), the CLI, and the git-parsing + sqlite storage implementation. Minor inconsistency: registry/metadata labels the skill as 'instruction-only' yet the package includes multiple code files and a setup.sh installer — practical but inconsistent metadata.
SKILL.md and the CLI commands instruct only local actions (reading git repos, writing to a local SQLite DB, exporting formatted text). The instructions and code reference only filesystem paths and git; they do not request or send data to external services. The tool does ask the user to provide repo paths, which means it can read any repository the user points it at (expected for this purpose).
There is no remote download/install step; setup.sh is included and is an idempotent local installer that creates ~/.nex-changelog and installs a wrapper into ~/.local/bin. This is low-risk, but you should inspect/approve setup.sh before running because it will add files to your home directory and PATH.
The skill requests no environment variables or external credentials. It stores project metadata and optional client emails in a local SQLite DB under the user's home directory — appropriate for the stated functionality.
The installer creates a data directory (~/.nex-changelog) and a CLI wrapper in ~/.local/bin, which grants persistent, per-user presence (normal for a CLI tool). always: false (no forced global persistence). This is expected behavior for a local CLI but is a permanent change that the user should be aware of.
Guidance
This package appears to be a local, self-contained CLI for generating changelogs and release notes. Before installing: (1) review setup.sh (it writes to ~/.nex-changelog and installs a wrapper in ~/.local/bin), (2) ensure you only point the tool at repositories you trust (it will read any repo path you provide), and (3) test it in a safe environment if you have concerns. Note: the registry metadata claims 'instruction-only' though code and installer are included; this metadata mismatch is benign but worth noting. Also expect some runtime issues (minor parsing/implementation bugs visible in the source) — no network calls or credential exfiltration were found.
Latest Release
v1.0.0
Initial release
More by @nexaiguy
Published by @nexaiguy on ClawHub
