Skip to content
TrustedSkillsbeta
Back to all skills

Claw Release

Checked
prompt-security·vlatest·devops·AGPL-3.0

This "Claw Release" skill safely removes sensitive credentials from code repositories, preventing accidental exposure and bolstering security practices.

Repository

Install on your platform

This skill no longer installs under the name claw-release. SKILL.md is marked internal, so the skills CLI hides it.

We check each listing against its upstream repository with the rules the skills CLI uses, last on 2026-10-22. We don't show a command we know will fail.

Repository install instructions

What we know about this skill

Publisher

prompt-security

Taken from the source listing. We haven't verified who controls this account.

Install target

Live repository

Not pinned. Installing fetches whatever the repository holds at the time you run the command.

No human has reviewed this code. The checks below are a static scan of the files at one commit — nobody has run this skill or judged whether it works. A skill runs with whatever access you give your agent, so read the source before you install it.

Automated safety checks

scanned

This skill passed all 6 checks. We read its files at one commit and looked for the things that make a skill dangerous to run — not for whether it works.

  • Declares what it does: passed

    SKILL.md parses and declares a name and a description.

    SKILL.md exists, its frontmatter parses, and it declares a name and a description.

  • No undeclared network calls: passed

    Makes no network calls.

    Every host the skill dials — from its scripts, its config endpoints or the commands it tells the agent to run — is either well-known package and API infrastructure or declared in its own frontmatter. Links in documentation are not counted.

  • No obfuscated payloads: passed

    No encoded or obfuscated payloads.

    No base64, hex or compressed blob is decoded and then executed, and no encoded shell commands.

  • No credential access: passed

    Reads no keys, tokens, keychains or credential files.

    Neither the code nor the SKILL.md instructions read SSH keys, cloud credentials, keychains, token stores, browser cookie databases or dotfiles that hold secrets.

  • No pipe-to-shell installers: passed

    No pipe-to-shell or download-and-run installers.

    No `curl … | sh` pattern, in the code or in the instructions, that runs code fetched at run time.

  • Pinned to a commit: passed

    Scanned prompt-security/clawsec at c8faf9de88.

    The exact upstream commit SHA that was scanned is recorded, so the result refers to specific bytes.

Commit
c8faf9de88
Manifest
skills/claw-release/SKILL.md
Scanned
4 files, 351 lines
This is a static scan, not a review. It reads the skill's files; it does not run them, and it cannot tell you whether the skill is any good or whether the code does what its description says. A skill runs with whatever access you give your agent.
What each check looks for →

About this skill

What it does

The Claw Release skill is an internal tool developed by Prompt Security to automate the release and management of skills within the ClawSec catalog. It streamlines the process of versioning, tagging, committing changes, pushing updates to a remote repository (GitHub), and publishing GitHub Releases for these skills. This ensures consistent and reliable distribution of skills while maintaining proper version control.

When to use it

This skill is intended for specific scenarios:

  • Releasing new versions of Prompt Security skills.
  • Publishing pre-release versions (beta, alpha, release candidates) of skills.
  • Managing the ClawSec catalog and ensuring accurate skill metadata.
  • Automating the creation of GitHub Releases with associated checksums and packages.

Key capabilities

  • Automates version incrementing based on change type (patch, minor, major, pre-release).
  • Validates semantic versioning format.
  • Updates skill.json and SKILL.md files with the new version number.
  • Creates annotated Git tags for releases.
  • Pushes commits and tags to a remote GitHub repository.
  • Generates checksums from Software Bill of Materials (SBOM).
  • Creates .skill packages (ZIP archives) for distribution.
  • Automatically marks pre-release versions in GitHub Releases.

Example prompts

Due to the nature of this tool, it is not directly prompted by a user. Instead, it's executed via command line:

  • ./scripts/release-skill.sh <skill-name> <new-version> (e.g., ./scripts/release-skill.sh my-skill 1.2.3)
  • ./scripts/release-skill.sh <skill-name> 1.0.0-beta1

Tips & gotchas

  • Internal Use Only: This skill is designed for internal use by Prompt Security maintainers and should not be used externally.
  • Prerequisites: Requires bash, git, jq, and gh (GitHub CLI) to be installed and configured. Authenticated GitHub CLI with permission to create releases is also needed.
  • Clean Working Tree: The script requires a clean working tree before execution to avoid conflicts.