Borrowing it
Nothing to install: this file belongs to ATaC-team/ATaC. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ATaC-team/ATaC/main/.agents/skills/atac-release/SKILL.mdgit clone --depth 1 https://github.com/ATaC-team/ATaCWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/atac-team/atac/atac-release)<a href="https://agentmods.dev/skills/atac-team/atac/atac-release"><img src="https://agentmods.dev/badge/skills/atac-team/atac/atac-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/atac-team/atac/atac-release"><img src="https://agentmods.dev/badge/skills/atac-team/atac/atac-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.00778 |
| Opus 5.5 | $0.00018 | $0.00311 |
| Sonnet 5.5 | $0.00009 | $0.00156 |
| Haiku 4.5 | $0.00005 | $0.00078 |
Grade A, and why
atac-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 35 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ATaC release
Run commands from the repository root. This project releases through GitHub tags and GitHub Releases; npm package validation does not imply npm publication.
Release conventions
- Use the requested version. If none is specified, use the version agreed in the conversation; otherwise increment the latest stable patch version.
- Keep
package.json, both root versions inpackage-lock.json, the leadingCHANGELOG.mdentry, and tagvX.Y.Zconsistent. Usenpm version X.Y.Z --no-git-tag-versionto update package versions. - Follow the existing changelog structure:
## [X.Y.Z] - YYYY-MM-DD, then### 中文and### English, with matching feature/change/fix bullets. Use only relevant subsections and preserve historical entries. - Describe user-visible changes since the previous release. Do not include development steps, abandoned designs, draft labels, test execution reports, or fixes to bugs that were never released. Do not generate release notes from commit messages.
Prepare and publish
- Inspect the worktree, latest release/tag, remote
main, and changes since the last release. Include the user's authorized changes, including earlier unpushed commits. Do not discard unrelated edits. Follow any explicit branch or PR request; otherwise release frommain. - Update versions and the bilingual changelog. Generate and review the exact release text:
The script validates version agreement and the leading bilingual changelog entry, then appends the pinned pi installation command.node scripts/release-notes.mjs vX.Y.Z > /tmp/atac-release-notes.md - Run
npm run check,npm test,npm run test:package, andgit diff --check. Relevant checks that already passed for the same code need not be repeated; package validation must cover the release version. Run the release-note tests after changing the release script. - Commit the authorized changes and version/changelog updates. Push
main, then create an annotatedvX.Y.Ztag on that commit and push the tag. Confirm the release commit is on remotemainbefore pushing the tag. Existing published tags are immutable: never force-push or retarget one as a recovery step. - The tag triggers
.github/workflows/release.yml. It validates release metadata and main-branch ancestry, reuses the Node.js 22/24 CI matrix, then createsRelease vX.Y.Zusing the changelog text. It usesGITHUB_TOKEN; no PAT or npm token is needed. Let this workflow create the Release instead of racing it with a manualgh release create. - Wait for the release workflow, then verify the tag commit, published Release URL, version, bilingual body, and worktree state. Report the release URL and any remaining changes. Do not report success while checks or publication are pending.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago First seen · 35 lines · 46 tokens per session scan A a49f920d144e
atac-release is a skill published in the GitHub repository ATaC-team/ATaC (293 stars, last pushed 25d ago), licensed MIT. It adds 46 tokens to every session and 778 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-13.
atac-release compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| atac-releaseATaC-team/ATaC | Skill | 293 | 25d ago | MIT | A | 46 | Claude Code, Codex |
| zb-release-pipelineAdamBien/airails | Skill | 62 | yesterday | MIT | A | 148 | Claude Code, Codex |
| npm-publishmetarhia/metaskills | Skill | 60 | 7d ago | MIT | A | 59 | Claude Code |
| apply-semantic-versioningpjt222/agent-almanac | Skill | 43 | yesterday | MIT | A | 94 | Claude Code |
| create-github-releasepjt222/agent-almanac | Skill | 43 | yesterday | MIT | A | 73 | Claude Code |
| capgo-release-managementCap-go/capgo-skills | Skill | 77 | 20d ago | MIT | A | 162 | Claude Code |
| release-notesjcottam/agent-resources | Skill | 23 | 13d ago | MIT | A | 87 | Claude Code |