Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Arenukvern/mcp_flutter --skill release-changelog-harnessgit clone --depth 1 https://github.com/Arenukvern/mcp_flutterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arenukvern/mcp_flutter/release-changelog-harness)<a href="https://agentmods.dev/skills/arenukvern/mcp_flutter/release-changelog-harness"><img src="https://agentmods.dev/badge/skills/arenukvern/mcp_flutter/release-changelog-harness/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/arenukvern/mcp_flutter/release-changelog-harness"><img src="https://agentmods.dev/badge/skills/arenukvern/mcp_flutter/release-changelog-harness.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 3 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 153 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 156 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 192 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 129 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.02499 |
| Opus 5.5 | $0.00034 | $0.01000 |
| Sonnet 5.5 | $0.00017 | $0.00500 |
| Haiku 4.5 | $0.00008 | $0.00250 |
Grade A, and why
release-changelog-harness scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- release-changelog-harness — 100% identical, 4 lines differ
How it starts
The opening of the file, as written. The whole thing — 198 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Release & changelog harness
Make releases understandable: every version bump has structured intent that agents and humans can read in git—not only in a maintainer’s head or a GitHub Releases textarea.
This skill is meta harness culture (which tool, which gates, which docs). It is not a full tutorial for every package manager.
Mixture of experts — critique your idea
| Expert lens | Verdict on “use JS Changesets everywhere” |
|---|---|
| JS monorepo maintainer | Strong default: .changeset/*.md + changeset version beats hand-editing five package.json files. |
| Dart / Flutter publisher | Weak fit as-is: pub uses tags + CHANGELOG.md; monorepos often use Melos version / changelog, not npm Changesets. |
| Rust / Go shipper | Use release-plz, cargo-release, or git-cliff—forcing Changesets adds alien workflow. |
| Agent operator | Wins when notes live as small structured files in git agents can read and PR—not prose-only in Slack. |
Multi-repo steward (~/mcp) |
One legibility contract across siblings; different generators per ecosystem is fine. |
| Skill Steward charter | Teach when + gate + doc placement; link to upstream docs; do not paste 200-line configs into SKILL.md. |
Improved framing (use this):
Adopt the release legibility contract first; pick the ecosystem-native generator second (Changesets is one excellent generator for JS workspaces, not the universal hammer).
See mixture-of-experts.md for extended debate and anti-patterns.
Release legibility contract (normative)
Before picking a tool, agree the repo obeys:
- Notes in git — Changelog or changeset files are versioned; not release-notes-only in a web UI.
- Structured contributor input — Contributors add intent in a fixed shape (e.g.
.changeset/foo.md, conventional commit scope, or ADR note)—not “bump version when you remember.” - Mechanical publish path — One documented command sequence in DX_FAQ; CI is the source of truth for “can ship.”
- Agent-readable output — Post-release,
CHANGELOG.md(or per-package changelogs) reflects what shipped; agents can answer “what changed in vX?” - Why is recorded — Non-obvious toolchain choice → short ADR or DESIGN_FAQ Q&A.
- Install trust matches release truth — The latest GitHub Release, release assets, checksums, package versions, and install docs must agree; stale pinned install examples are release drift.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 198 lines · 84 tokens per session scan A 8c654537fb45
release-changelog-harness is a skill published in the GitHub repository Arenukvern/mcp_flutter (393 stars, last pushed 10d ago), licensed MIT. It adds 84 tokens to every session and 2,499 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
he-ship
Deliver a verified build through a task branch and PR, check the intended remote result, and clean up the completed task safely. Use for PR creation, shipping, merging or release/deployment requests; skip planning, implementation and review-only work.
publish-notes
Draft user-facing release notes, store changelogs, and internal publish summaries.
polish-docs-meta
Finalize documentation and project metadata for a ship-ready release. Use after implementation is complete, tests pass, and devcheck is clean. Safe to run at any stage — each step checks current state and only acts on what still needs work.
repository-manager-workspace-release
Preview the topologically-phased version-bump plan across a workspace, drive validation with an explicitly consented chain into version bump and phased push, and manage the workspace.yml manifest — via rmworkspace and rmprojects. Nothing here pushes or bumps without an explicit opt-in on the call that triggers it…
changelog-notes
Draft user-facing changelog bullets from a diff or merged PR. Use when writing release notes, CHANGELOG entries, or a PR summary for humans.
publish-release
Releases a new McpOrchestrator version end to end — version bump PR, tag, and the automated deploy to GitHub Releases, NuGet, and the MCP Registry. Use when asked to release, publish, deploy, ship, or bump the version of McpOrchestrator.