vscode-deck: Skill for Claude Code

.agents/skills/release/SKILL.md

release is a skill for Claude Code, Codex from a9a4k/vscode-deck. It costs 82 tokens per session (855 once invoked), scanned C, original, MIT.

A release workflow for the vscode-deck extension. It checks that the working tree is clean, the project is on the main branch, and tests pass before updating the version, creating a release commit and tag, and building a VSIX package.

In plain words
What is it for?
Use it to prepare a specific extension version for release and build its installable VSIX file; publishing to Git or the VS Code Marketplace is outside its scope.
Why use it?
It keeps release steps and commit naming consistent while stopping when important preconditions are not met.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents).

This is a9a4k/vscode-deck's own configuration. It tells Claude Code and Codex how to work on vscode-deck itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything vscode-deck configures →

Reuse

Borrowing it

Nothing to install: this file belongs to a9a4k/vscode-deck. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/a9a4k/vscode-deck/main/.agents/skills/release/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/a9a4k/vscode-deck

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for release

README.md
[![agentmods](https://agentmods.dev/badge/skills/a9a4k/vscode-deck/release/github.svg)](https://agentmods.dev/skills/a9a4k/vscode-deck/release)
Your own site
<a href="https://agentmods.dev/skills/a9a4k/vscode-deck/release"><img src="https://agentmods.dev/badge/skills/a9a4k/vscode-deck/release/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for release

Your own site · 80×15
<a href="https://agentmods.dev/skills/a9a4k/vscode-deck/release"><img src="https://agentmods.dev/badge/skills/a9a4k/vscode-deck/release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 82 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 855 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00082 $0.00855
Opus 5.5 $0.00033 $0.00342
Sonnet 5.5 $0.00016 $0.00171
Haiku 4.5 $0.00008 $0.00085

Measured 1mo ago against content hash 3ab329281931, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

release scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

Note: `npm version` may strip linux-only optional peer entries from `package-lock.json` on darwin. That's the accepted status quo — sandcastle's next merger detects the drift and auto-commits `fix: synchronize npm lockfi
.agents/skills/release/SKILL.md · 79 lines

How it starts

The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Release

Cut a new release of the vscode-deck extension.

Preconditions to check first (fail loudly if any miss):

  • Working tree is clean (git status --short prints nothing).
  • On main branch.
  • npm test passes.

Steps

  1. Read current version and pick target. Read package.json for the current version. Ask the user for the explicit target X.Y.Z (this skill does not compute bumps — you pick the exact version). Show recent releases for context:

    git log --oneline --grep='chore(release)' -5
    
  2. Ask for the summary line. The commit title format is:

    chore(release): X.Y.Z — <summary>
    

    Summary is one line, often ends with issue refs like (#151, #152, #153). Look at recent releases for tone. If the release has more nuance than one line can hold, ask if they want a longer commit body — otherwise the message is just the title + Co-Authored-By trailer.

  3. Write the changelog entry. Add a user-facing ## X.Y.Z entry to CHANGELOG.md, directly below the title so entries remain newest-first. Summarize what changed as readable release notes rather than copying commit messages.

  4. Bump.

    npm version <target> --no-git-tag-version
    

    Updates package.json and package-lock.json version fields. Does not create a tag (we make one manually in step 5 so the commit format stays clean).

    Note: npm version may strip linux-only optional peer entries from package-lock.json on darwin. That's the accepted status quo — sandcastle's next merger detects the drift and auto-commits fix: synchronize npm lockfile. Don't try to regen the lockfile here (a fresh rm -rf node_modules && npm install can pull newer transitive deps, drifting the release from what was tested).

  5. Commit. Use a HEREDOC to preserve formatting:

    git add CHANGELOG.md package.json package-lock.json
    git commit -m "$(cat <<'EOF'
    chore(release): X.Y.Z — <summary>
    
    Co-Authored-By: <your model attribution> <[email protected]>
    EOF
    )"
    

    Attribution: use the current session's model name (e.g. Claude Opus 4.7, Claude Fable 5). Do not hardcode.

Read the full file on GitHub · 79 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +5 lines 3ab329281931
  2. 2mo ago First seen · 74 lines · 82 tokens per session scan C 3f87d4cec841

Subscribe to this mod's changes

release is a skill published in the GitHub repository a9a4k/vscode-deck (14 stars, last pushed 16d ago), licensed MIT. It adds 82 tokens to every session and 855 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.