Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/amirisback/automated-build-android-app-with-github-action/github-workflowsnpx skills add amirisback/automated-build-android-app-with-github-action --skill github-workflowsgit clone --depth 1 https://github.com/amirisback/automated-build-android-app-with-github-actionWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00019 | $0.00515 |
| Opus 5 | $0.00010 | $0.00258 |
| Sonnet 5 | $0.00004 | $0.00103 |
| Haiku 4.5 | $0.00002 | $0.00052 |
Grade A, and why
github-workflows scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Workflows Skill
This skill provides instructions for managing, extending, and troubleshooting the GitHub Actions workflows in the automated-build-android-app-with-github-action project.
Workflow Overview
The repository contains several workflows located in .github/workflows/:
- Android CI (Main):
android-ci-generate-apk-aab-upload-push-github.yml: Builds APK/AAB and pushes the results to thebuildActionResultfolder in the repository.android-ci.yml: Basic CI for building and testing.
- Artifact Management:
android-ci-generate-apk-aab-upload.yml: Builds and uploads artifacts to GitHub Actions.android-ci-generate-apk-aab-download.yml: Research workflow for downloading artifacts.
- Deployment:
android-ci-publish-play-store.yml: (In research) Template for publishing to Google Play Store.
Key Environment Variables
Each workflow uses common environment variables defined at the top of the file:
main_project_module: Usuallyapp.playstore_name: Display name for the app (e.g.,Frogobox ID).build_output_path: Directory where build results are stored (e.g.,buildActionResult).
Common Tasks
Adding a New Build Step
To add a new Gradle task to a workflow, insert a new step in the jobs.build.steps section:
- name: Your Task Name
run: ./gradlew yourTaskName
Modifying the Output Directory
If you want to change where the APKs/AABs are pushed in the repository, update the build_output_path env variable.
Triggering Workflows
- Push: Workflows are typically triggered on push to
release/**branches. - Manual: Use
workflow_dispatchto trigger manually from the GitHub Actions tab.
Troubleshooting
- Permissions: Ensure
./gradlewhas execution permissions (chmod +x ./gradlew). - JDK Version: Workflows use JDK 17 by default. Ensure compatibility with your Gradle version.
- Secrets: Deployment workflows require secrets like
SIGN_KEY,ALIAS,STORE_KEY_PASSWORD, andKEY_PASSWORD.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 53 lines · 19 tokens per session scan A a505a08cb4b3
github-workflows is a skill published in the GitHub repository amirisback/automated-build-android-app-with-github-action (339 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 19 tokens to every session and 515 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
turborepo
Turborepo monorepo build system guidance. Triggers on: turbo.json, task pipelines, dependsOn, caching, remote cache, the "turbo" CLI, --filter, --affected, CI optimization, environment variables, internal packages, monorepo structure/best practices, and boundaries. Use when user: configures tasks/workflows/pipelines…
monitor-ci
Monitor Nx Cloud CI pipeline and handle self-healing fixes. USE WHEN user says "monitor ci", "watch ci", "ci monitor", "watch ci for this branch", "track ci", "check ci status", wants to track CI status, or needs help with self-healing CI fixes. Prefer this skill over native CI provider tools (gh, glab, etc.) for CI…
github-script
Write robust JavaScript for GitHub Actions github-script steps.
github-workflows-query
List GitHub Actions workflows with perpage pagination support.
restricted-tool-triage
Operate safely and efficiently inside a gh-aw workflow with a restricted tools/bash allowlist, and correctly triage tool-denial events before they exhaust the session's denial budget.
ci-triage
Classify CI failures — distinguish clear regressions from infra flakes and security-test failures. Produces structured failure reports.