ReleaseGuard Skill

ReleaseGuard is an artifact policy engine. Use it to scan build outputs for secrets, misconfigurations, and supply-chain risks; harden and fix them; generate SBOMs; sign artifacts; and verify release integrity.

Install ReleaseGuard

Preferred — Homebrew (macOS / Linux, no remote script execution):

CODEBLOCK0

Alternative — manual download from GitHub Releases (review before running):

CODEBLOCK1

Alternative — direct binary download (no shell script):

CODEBLOCK2

Note: The install script is MIT-licensed and open-source at
https://github.com/Helixar-AI/ReleaseGuard/blob/main/scripts/install.sh
Review it before executing in sensitive environments.

External Services

Some commands interact with external services. This is documented per-command below. No data is sent externally unless you explicitly invoke the relevant flag or mode:

Credentials: Keyless signing requires an OIDC token (available in GitHub Actions, GitLab CI, etc.). Local signing requires a private key file you supply with --key. Cloud features require RELEASEGUARD_CLOUD_TOKEN. No credentials are used by default for check, fix, sbom, pack, report, or verify.

Commands

Check / Scan — releaseguard check <path>

Scan an artifact path and evaluate the release policy. No external network calls.

Trigger phrases: "scan", "check", "audit", "analyze release", "inspect dist", "any secrets", "find vulnerabilities"

CODEBLOCK3

• - Default format: cli (human-readable)
• Other formats: json, sarif, markdown, INLINECODE17
• Exit code 0 = PASS, non-zero = FAIL

Fix — releaseguard fix <path>

Apply safe, deterministic hardening transforms. No external network calls.

Trigger phrases: "fix", "harden", "apply fixes", "remediate", "auto-fix release"

CODEBLOCK4

SBOM — releaseguard sbom <path>

Generate a Software Bill of Materials.

Trigger phrases: "sbom", "software bill of materials", "dependencies", "generate bom"

CODEBLOCK5

• - Default format: INLINECODE20
• INLINECODE21 makes read-only requests to OSV.dev; no credentials required

Obfuscate — releaseguard obfuscate <path>

Apply obfuscation to release artifacts.

Trigger phrases: "obfuscate", "strip symbols", "protect binary"

CODEBLOCK6

Levels:

• - none / light — local, no external calls (OSS)
• INLINECODE25 / aggressive — calls ReleaseGuard Cloud API; requires INLINECODE27

Harden — releaseguard harden <path>

Full hardening pipeline: fix + obfuscate + DRM injection.

Trigger phrases: "full harden", "harden release", "full hardening pipeline"

CODEBLOCK7

Pack — releaseguard pack <path>

Package an artifact into a canonical archive. No external network calls.

Trigger phrases: "pack", "package artifact", "create archive"

CODEBLOCK8

Sign — releaseguard sign <artifact>

Sign an artifact and its evidence bundle.

Trigger phrases: "sign", "cosign", "keyless sign", "sign artifact"

CODEBLOCK9

• - keyless mode contacts Sigstore's Fulcio CA and Rekor transparency log
• INLINECODE32 mode is fully offline; key stays on disk

Attest — releaseguard attest <artifact>

Emit in-toto and SLSA provenance attestations.

Trigger phrases: "attest", "provenance", "slsa", "in-toto"

CODEBLOCK10

Verify — releaseguard verify <artifact>

Verify artifact signatures and policy compliance. No credentials required for verification.

Trigger phrases: "verify", "check signature", "validate artifact"

CODEBLOCK11

Report — releaseguard report <path>

Export a scan report. No external network calls.

Trigger phrases: "report", "export report", "compliance report"

CODEBLOCK12

VEX — releaseguard vex <path>

Enrich SBOM with VEX vulnerability data. Makes read-only requests to OSV.dev.

Trigger phrases: "vex", "vulnerability data", "enrich sbom"

CODEBLOCK13

Typical Workflows

Quick scan (no network, no credentials)

Full pipeline (CI with keyless signing)

Offline pipeline (no network, local key)

releaseguard check ./dist
releaseguard fix ./dist
releaseguard sbom ./dist
releaseguard pack ./dist --out release.tar.gz
releaseguard sign release.tar.gz --mode local --key signing.key

Configuration

CODEBLOCK17

CODEBLOCK18