Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/agent-tower/core/github-desktop-releasenpx skills add agent-tower/core --skill github-desktop-releasegit clone --depth 1 https://github.com/agent-tower/coreWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00063 | $0.00799 |
| Opus 5 | $0.00032 | $0.00400 |
| Sonnet 5 | $0.00013 | $0.00160 |
| Haiku 4.5 | $0.00006 | $0.00080 |
Grade A, and why
github-desktop-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
GitHub Desktop Release
用于通过 .github/workflows/build-desktop.yml 触发桌面端多平台打包,并生成 GitHub draft release。
触发机制
pushtag 且 tag 匹配v*:自动构建 macOS/Windows/Linux 桌面包,并创建或更新 draft GitHub Release。workflow_dispatch:只手动构建并上传 Actions artifacts,不创建 GitHub Release。
正式发布桌面包时优先用 tag push,不要只手动跑 Action。
发布前检查
- 确认工作区状态:
git status --short
- 确认当前版本来源:
- npm/server 版本在
packages/server/package.json - desktop 包版本在 tag workflow 中由 tag 临时写入
packages/desktop/package.json - tag 必须是 semver 形式,例如
v0.5.2-beta.6
- 构建前本地至少验证:
pnpm --filter @agent-tower/server build
pnpm --filter @agent-tower/desktop run package:prepare
如改过 Linux metadata 或 Electron Builder 配置,再跑:
pnpm --filter @agent-tower/desktop run package:linux
触发 GitHub 自动打包
- 创建并推送 tag:
git tag vX.Y.Z
git push origin vX.Y.Z
如果 tag 已存在且需要重发,先和用户确认。不要擅自删除或强推 tag。
- 查看 workflow:
gh run list --workflow "Build Desktop" --limit 5
gh run watch <run-id>
- 查看产物:
gh run download <run-id> --dir desktop-artifacts
- 查看 draft release:
gh release view vX.Y.Z
GitHub Release 行为
tag push 成功后 workflow 会:
- 在
macos-latest构建 macOS arm64 DMG - 在
windows-latest构建 Windows x64 NSIS installer 和 portable exe - 在
ubuntu-latest构建 Linux x64 AppImage 和 deb - 上传 Actions artifacts,保留 14 天
- 创建或更新 draft GitHub Release,并上传所有平台产物
发布 draft release 前,检查产物齐全后再执行:
gh release edit vX.Y.Z --draft=false
预发布版本可标记 prerelease:
gh release edit vX.Y.Z --prerelease --draft=false
常见问题
- Prisma 类型错误:确认
packages/server/package.json的build会先跑pnpm run db:generate。 - Windows
cp不存在:server build 资产复制应使用 Node 脚本,不用 Unix-onlycp。 - Linux deb 报
Please specify project homepage:packages/desktop/package.json顶层需要homepage。 - Linux WM_CLASS warning:顶层
desktopName配合build.linux.syncDesktopName: true。 - macOS 包目前未签名/未公证;正式分发前需要 Developer ID signing/notarization。
- Windows 包目前未签名;正式分发前需要代码签名。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 104 lines · 63 tokens per session scan A 8a07ec2b069d
github-desktop-release is a skill published in the GitHub repository agent-tower/core (338 stars, last pushed 21d ago), licensed Apache-2.0. It adds 63 tokens to every session and 799 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…