What does this skill do, and when should you use it?
claw-release is an internal release-workflow skill in the ClawSec repository. It guides maintainers through semantic version selection, metadata updates, commits, tags, pushes, and GitHub Release verification. It also provides a signed-manifest procedure for checking an archive, SKILL.md, and skill.json before a standalone installation is trusted. It is intended for approved maintainers working from a trusted checkout with a clean tree.
Checks Git status, the target skill directory, and the current skill.json version; runs ./scripts/release-skill.sh to validate semantic-version format, check for an existing tag, update skill.json and SKILL.md versions, update hardcoded version URLs, create a commit, and create an annotated Git tag; pushes commits and tags with git push; relies on CI/CD to validate version consistency, generate SHA-256 checksums, build a .skill ZIP package, and create a GitHub Release; uses curl, openssl, jq, and hashing utilities to download and verify the signed manifest, public-key fingerprint, archive, SKILL.md, and skill.json.
- A ClawSec maintainer needs to ship a patch, minor, or major release for an existing skill and wants a guided release sequence.
- A maintainer is preparing a beta, alpha, or release-candidate version and needs the corresponding GitHub tag format.
- A team needs to verify a standalone skill archive and its metadata before extracting or installing it.
- A maintainer needs to undo a local release before pushing while preserving the generated release changes for inspection or amendment.
How do you install this skill?
- This skill creates commits and tags, pushes to a remote, and publishes GitHub Releases; verify the checkout, repository target, version, and GitHub permission scope before use.
- Signature verification depends on GitHub Release assets, network access, curl, openssl, jq, and the pinned key fingerprint; the core verification flow cannot complete if assets or connectivity are unavailable.
- The target skill has no Chinese operating instructions; mainland-China users may encounter reachability issues with GitHub, npm, or npx.
- This review read source files only and did not execute commands, scripts, or CI, so it cannot confirm that the release script or remote signature assets work at this revision.
- Shell / CLI
- Network access
- Local filesystem
bashgitjqGitHub CLI (gh)authenticated GitHub CLI credentials
In an environment supporting the Vercel Skills CLI, run: npx skills add prompt-security/clawsec --skill claw-release -a openclaw -y. The source does not document another installation directory or client-specific installation method.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/prompt-security/clawsec.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/claw-release" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
Once installed, send your agent any of these to trigger it:
- Prepare a release for <skill-name> at <new-version>, run pre-flight checks, then verify the GitHub Release.
From a trusted checkout with a clean working tree, after authenticating the GitHub CLI and obtaining maintainer approval, run: ./scripts/release-skill.sh <skill-name> <new-version>. To push the release, run: git push && git push origin <skill-name>-v<version>. Example request: “Prepare a release for <skill-name> at <new-version>, run pre-flight checks, then verify the GitHub Release.” The source does not define a more specific natural-language trigger syntax. For standalone installs, complete the signed release-manifest verification before trusting or extracting the archive.
What are this skill's strengths and limitations?
- Covers version selection, pre-flight checks, commits, tags, pushing, and post-release verification in one maintainer workflow.
- Verifies the signing-key fingerprint, checksums.json, archive, SKILL.md, and skill.json.
- Makes trust boundaries explicit by requiring a clean tree, trusted checkout, maintainer approval, and authenticated GitHub CLI.
- It is an internal maintainer tool, not an end-user security-protection skill.
- It can create commits and tags, push to a remote, and publish GitHub Releases, so its permissions and side effects are significant.
- It requires bash, git, jq, gh, network access, and GitHub credentials; the source provides no test-suite evidence.
- Its metadata identifies it as an internal OpenClaw skill, so other clients may require metadata or runtime adjustments.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| ClawSec Release Manager this page | 54 · Use with care | ★ 1.1k | 13d ago | AGPL-3.0 |
| Chops Release Pipeline Skill | 53 · Use with care | ★ 1.9k | 2mo ago | NOASSERTION |
| SmokedMeat E2E Testing Skill | 49 · Use with care | ★ 393 | 1mo ago | AGPL-3.0 |
| Prism Scanner — AI Agent Skill Security Scanner | 55 · Use with care | ★ 27 | 6mo ago | Apache-2.0 |
| NanoClaw Security Sentinel | 44 · Not recommended | ★ 1.1k | 13d ago | AGPL-3.0 |
How did FollowSkills review this skill?
The document explicitly discloses bash, git, jq, gh, authenticated GitHub credentials, and side effects including commits, tags, pushes, and GitHub Releases; it also requires a trusted checkout, clean worktree, and maintainer approval. However, it does not require explicit step-by-step confirmation before each high-impact command, and least-privilege credentials, full data-flow detail, post-push recovery, and rollback boundaries remain incomplete, so points are deducted.
The versioning, preflight, release, push, and verification flow is mostly self-consistent and includes set -euo pipefail, diagnostic errors, checksum checks, and a soft pre-push rollback. However, the key release script, CI coverage, and abnormal paths are not provided for reproducible review, while the workflow depends on external commands and remote Release assets; under static calibration it cannot exceed 10, so points are deducted.
The audience, internal maintainer scenario, triggers, inputs, and ordinary-user non-fit are reasonably clear. However, it is narrowly tailored to the ClawSec maintenance workflow, depends on GitHub/npx and local tooling, and provides no Chinese-language or mainland-China reachability guidance, so points are deducted.
SKILL.md, README, skill.json, and CHANGELOG provide clear layering and include version, license, author, dependencies, triggers, operational notes, limitations, change history, and maintainer attribution. Maintenance ownership, support channels, compatibility policy, and the complete update path remain brief, and several prerequisites depend on files elsewhere in the repository, so points are deducted.
It supplies directly reusable commands for installation, version classification, preflight checks, release execution, pushing, verification, and pre-push undo, covering the core release task. However, the supplied static material does not prove successful execution at the assessed revision, and the maintainer must still classify changes, authorize credentials, and handle external failures; points are conservatively deducted within the static ceiling.
The skill includes versioned metadata, a pinned public-key fingerprint, signature and checksum verification, and references to CI/tests, providing useful audit hooks. But the supplied material lacks complete target-skill key-path tests or independent execution results, so remote assets and signature behavior cannot be confirmed statically; the score is capped below 5 and reduced accordingly.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →