Changelog from Commits

The Express repository, last 15 commits: dependency bumps with CVE notes in the commit bodies, CI updates, a docs fix and one bug fix.

After (skill output, excerpt):

Security

• Raised the minimum qs version to 6.16.0, which patches CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx). (3b7e39f)

Fixed

• res.send now still generates an ETag when a Transfer-Encoding header is set. (9a34acf)

[CHECK: 98bd4cd "deps: proxy-addr@^2.0.8 (#7474)"] The message gives no reason for the bump.
Skipped commits: 11

Give it a commit range in a repo, or paste git log output. You get a changelog section in Keep a Changelog style, written for the people who use the project, with the commit hash behind every line. Vague commits and possible breaking changes are flagged instead of guessed.

1 real-data run on the public Express repository (Claude Sonnet, 15 commits). Every entry matched a commit message; the one vague commit was flagged.

1 real-data run on the public Express repository (Claude Sonnet, 15 commits). We checked each entry against the commit bodies: the CVE ids and the body-parser behaviour change are in the messages, nothing was invented, and the one vague commit was flagged.

Tested on a real example before release. The example is shown in the Before and after section above.

How we test, what we do not do, and which assistants we ran it on.

• It sees commit messages, and diffs only when it can.
• Breaking changes only from evidence.
• It writes text; it does not tag or publish.

Works with any assistant that reads SKILL.md skills (Claude, Codex, Gemini CLI, Cursor and others), plus a paste-in prompt version for ChatGPT or any chatbot. A repo with git, or pasted git log output.

1. Run npx skills add proskillpacks/skills in your project and pick this skill. Or copy the changelog-from-commits folder from GitHub (https://github.com/proskillpacks/skills/tree/main/skills/developers/changelog-from-commits).
2. Put the changelog-from-commits folder where your assistant looks for skills. The generic path is .agents/skills/ (or npx skills add from a folder). Tool-specific paths:
   • Claude Code: ~/.claude/skills/ (or .claude/skills/ inside one project)
   • OpenAI Codex, Gemini CLI, Cursor and others: .agents/skills/ or the skills folder their docs name
   • claude.ai: zip the skill folder yourself, then Customize, Skills, the plus button, Create skill, Upload a skill (code execution must be on in Settings, Capabilities)
   • ChatGPT or any chatbot: open the skill's prompt.md, paste it into the chat, then paste your own text or link
   • Steps for each tool, with links to its official docs: how to install Agent Skills
3. Ask for the job in plain words, for example: "Write the changelog for everything since the last tag.". The skill loads by itself.