sergeyklay/commit-history
.github/skills/commit-history/SKILL.md
Fetch commit history between package versions from GitHub when changelog is unavailable. Use this skill when (1) changelog analysis failed to provide sufficient information, (2) changelog exists but breaking changes are unclear, (3) evaluating packages without public release notes. Works with both npm/yarn (Node.js) and Composer (PHP) packages. Requires the package repository to be publicly accessible on GitHub.
$ install --global
skillsauthnpx skillsauth add sergeyklay/groster commit-historyInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 15, 2026, 6:11 AM6.9s3 files scanned
SKILL.md
- name:
- commit-history
- description:
- Fetch commit history between package versions from GitHub when changelog is unavailable. Use this skill when (1) changelog analysis failed to provide sufficient information, (2) changelog exists but breaking changes are unclear, (3) evaluating packages without public release notes. Works with both npm/yarn (Node.js) and Composer (PHP) packages. Requires the package repository to be publicly accessible on GitHub.
Commit history
Fallback analysis when standard changelog sources fail. Only supports public GitHub repositories.
References
- Commands reference - Detailed gh CLI commands for repository resolution, tag lookup, and commit extraction
- Output templates - Report formats for complete, partial, and unavailable analysis results
Workflow
- Detect ecosystem - Node.js (npm/yarn) or PHP (Composer)
- Resolve repository URL - Get GitHub repo from package metadata
- Extract owner/repo - Parse URL to
owner/repoformat - Resolve version tags - Map package versions to Git tags
- Fetch commit comparison - Use GitHub compare API
- Categorize commits - Group by conventional commit type
- Generate report - Structured analysis with recommendations
Ecosystem detection
| Indicator | Ecosystem |
| --- | --- |
| package.json exists | Node.js (npm/yarn) |
| composer.json exists | PHP (Composer) |
| Package name starts with @ | Node.js scoped package |
| Package name contains / (e.g., vendor/package) | PHP Composer package |
Step 1: Resolve repository URL
Find the package's GitHub repository based on ecosystem.
Node.js (npm/yarn):
npm view <package-name> repository.url 2>/dev/null
PHP (Composer):
composer show <vendor/package> --format=json 2>/dev/null | jq -r '.source.url // empty'
Internal packages may point to GitLab/Bitbucket. This skill only supports public GitHub repositories.
Step 2: Extract owner/repo
Parse the repository URL to extract GitHub owner and repo:
| URL format | Example | Extracted |
| --- | --- | --- |
| git+https://github.com/owner/repo.git | git+https://github.com/axios/axios.git | axios/axios |
| https://github.com/owner/repo | https://github.com/facebook/react | facebook/react |
| git://github.com/owner/repo.git | git://github.com/lodash/lodash.git | lodash/lodash |
| [email protected]:owner/repo.git | [email protected]:symfony/console.git | symfony/console |
Non-GitHub URLs indicate this skill cannot help. Return COMMITS_UNAVAILABLE.
Step 3: Resolve version tags
Package versions must map to Git tags. Try patterns in order: v1.2.3, 1.2.3, release-1.2.3.
gh api repos/<owner>/<repo>/tags --jq '.[0:20] | .[].name'
Match the version to the appropriate tag format for both source and target versions.
Step 4: Fetch commit comparison
gh api repos/<owner>/<repo>/compare/<from-tag>...<to-tag>
Returns total_commits, commits[] array, and status (ahead/behind/identical/diverged).
Step 5: Categorize commits
| Prefix | Category | Risk |
| --------------------------------- | ------------ | ------ |
| feat!:, BREAKING CHANGE | Breaking | High |
| fix!: | Breaking fix | High |
| feat:, feat( | Feature | Medium |
| fix:, fix( | Bug fix | Low |
| perf: | Performance | Medium |
| refactor: | Refactor | Medium |
| chore:, docs:, ci:, test: | Maintenance | Low |
Commits without conventional prefixes require manual review.
Step 6: Generate analysis
Produce a structured report:
- Total commits between versions
- Categorized commit breakdown
- Potential breaking changes (based on
!marker or message content) - Notable features and fixes
See output templates for report formats.
Limitations
| Limitation | Impact | Mitigation | | ---------------------------- | --------------------------------------------- | ------------------------------------------- | | GitHub only | GitLab, Bitbucket, internal repos unsupported | Report as unsupported | | Public repos only | Private GitHub repos require authentication | Check if repo is accessible | | Tag format varies | Some packages don't tag releases | Try common patterns, fallback if none match | | Non-conventional commits | Cannot auto-categorize impact | Flag for manual review | | Monorepos | Commits may include unrelated changes | Filter by package path if detectable |
Graceful degradation
This skill must never block the dependency update workflow.
When commit history cannot be retrieved:
- Return
COMMITS_UNAVAILABLEstatus with reason - Include what was attempted (repo resolution, accessibility, tags)
- Recommend verification-based approach (typecheck, lint, build, test)
Language
Communicate with the user in their language. However, ALL reports, summaries, and documentation written to project files MUST be in English only.
Related Skills
sergeyklay/structuring-tasks
development
VerifiedTrustedCommunity
Transform raw feature descriptions, bug reports, or ideas into structured task documents with YAML frontmatter and standardized sections. Use when asked to 'create a task', 'write a task file', 'structure this feature', 'turn this into a task', 'make a ticket', or when a .tasks/ directory exists and the user provides an unstructured feature description. Also use when refining or reformatting existing task files. Do NOT use for Jira ticket creation, spec writing, or implementation planning.
1SKILL.mdUpdated Apr 15, 2026
sergeyklay/git-commit
development
VerifiedTrustedCommunity
Use when asked to commit, save, or persist changes to Git. Handles atomic commits, branch safety, Conventional Commits format, and project style matching. Do NOT use for pushing, creating PRs, or branch management beyond safety checks.
1SKILL.mdUpdated Apr 15, 2026
sergeyklay/creating-pr
research
VerifiedTrustedCommunity
Use when asked to create a pull request, open a PR, or submit changes for review. Handles branch verification, change analysis, title and description generation, and gh pr create. Do NOT use for committing (use git-commit), pushing without PR, or reviewing existing PRs.
1SKILL.mdUpdated Apr 15, 2026
sergeyklay/context-files
development
VerifiedTrustedCommunity
Create or validate project context files (AGENTS.md, CLAUDE.md, GEMINI.md). Use when bootstrapping a new project, initializing agent configuration, writing a context file, or when asked to create, review, audit, or validate an existing context file. Handles codebase archaeology, user interviews, golden-rule validation, and platform-specific formatting. Do NOT use for creating Agent Skills (use creating-agent-skills instead) or .instructions.md files (use agent-customization instead).
1SKILL.mdUpdated Apr 15, 2026