Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AtlasOmnia/hermes-custom-pack --skill local-app-github-publishinggit clone --depth 1 https://github.com/AtlasOmnia/hermes-custom-packWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/atlasomnia/hermes-custom-pack/local-app-github-publishing)<a href="https://agentmods.dev/skills/atlasomnia/hermes-custom-pack/local-app-github-publishing"><img src="https://agentmods.dev/badge/skills/atlasomnia/hermes-custom-pack/local-app-github-publishing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/atlasomnia/hermes-custom-pack/local-app-github-publishing"><img src="https://agentmods.dev/badge/skills/atlasomnia/hermes-custom-pack/local-app-github-publishing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.03297 |
| Opus 5.5 | $0.00014 | $0.01319 |
| Sonnet 5.5 | $0.00007 | $0.00659 |
| Haiku 4.5 | $0.00003 | $0.00330 |
Grade A, and why
local-app-github-publishing scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
files = subprocess.check_output(['git','diff','--cached','--name-only'], text=True).splitlines() This is a copy
100% identical to local-app-github-publishing — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 281 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Local App GitHub Publishing
Use this when the user asks to push a local app/prototype/project to GitHub for the first time, especially Electron, iOS/Xcode, mobile, desktop, or AI/API-integrated apps.
This skill complements the protected github-repo-management skill with the user-specific first-push hygiene: publish the useful source, not the machine's junk drawer wearing a trench coat.
Core Rule
Before the first commit, sanitize and verify. Generated builds, dependency folders, local Xcode state, and API credentials do not belong in the initial history.
Default Behavior
- Default visibility: private unless the user explicitly asks for public.
- Use a simple repo name matching the user's wording when possible, normalized to GitHub style, e.g. “iOS translator” →
ios-translator. - If the repo name exists, choose the closest available variant only if the user gave broad wording; otherwise ask.
- Set a repo-local git identity if global
user.name/user.emailare missing. - Verify the pushed remote before reporting success.
First-Push Workflow
- Confirm project and GitHub auth
cd /path/to/project
git --version
gh auth status
GH_USER=$(gh api user --jq .login)
gh api user --jq .id
- Check whether the target repo exists
gh repo view "$GH_USER/REPO" --json nameWithOwner,url,visibility 2>&1 || true
- Create or tighten
.gitignorebeforegit add
Include at least:
# Dependencies
node_modules/
.venv/
.venv-*/
# Build outputs
dist/
dist-*/
release/
release-*/
*.tsbuildinfo
# Local caches/logs
.npm-cache/
.npm-logs/
*.log
# Xcode / Apple local state
.DerivedData/
DerivedData/
*.xcuserstate
xcuserdata/
.DS_Store
# Environment / secrets
.env
.env.*
!.env.example
*.pem
*.p8
*.p12
*.mobileprovision
- Run a source-only secret scan
Exclude generated/dependency directories. Search for common key patterns:
AIza— Google/Gemini keyssk-— OpenAI-style keysghp_,github_pat_— GitHub tokenshf_— Hugging Face tokens-----BEGIN ... PRIVATE KEY-----
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 281 lines · 34 tokens per session scan A c23a939cf9d3
local-app-github-publishing is a skill published in the GitHub repository AtlasOmnia/hermes-custom-pack (70 stars, last pushed 7d ago), licensed MIT. It adds 34 tokens to every session and 3,297 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). It is 100% identical to local-app-github-publishing, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
dependency-update-bot
Scans your project for outdated npm, pip, Cargo, Go, or Ruby packages. Runs a CVE security audit. Fetches changelogs, summarizes breaking changes with Gemini, and opens one PR per risk group (patch, minor, major). Includes Diagnosis Mode for install conflicts. Use when asked to update dependencies, check for outdated…
explain-this-pr
Takes a GitHub PR URL or the current branch and writes a plain-English explanation of what it does and why, then posts it as a PR comment. Use when asked to explain a PR, summarize a pull request, write a plain-English description of a PR, add a summary comment to a PR, or understand what a PR changes. Trigger when a…
pr-description-writer
Use when the user asks to write, draft, generate, or update a GitHub pull request description for the current branch. Reads the branch diff and commit messages, writes a structured PR body (summary, changes, testing), and optionally creates or updates the PR via the gh CLI.
coding-worktree-recovery
Use this skill when coding-agent work is interrupted, an agent exits without a clean commit, multiple controllers target the same checkout, or the checkout produces inconsistent file/Git behavior.
github-pre-push-gates
Before pushing a branch to a shared remote, run through these gates. They prevent pushing credentials, PII, private history, or a broken tree. The skill covers the pre-PR quality phase — use github-pr-workflow for the PR lifecycle itself.
local-app-github-publishing
Use this when the user asks to push a local app/prototype/project to GitHub for the first time, especially Electron, iOS/Xcode, mobile, desktop, or AI/API-integrated apps.