Magnetar: Skill for Codex

.codex/skills/magnetar/hidden/publish/SKILL.md

publish is a skill for Codex from AXERA-TECH/Magnetar. It costs 31 tokens per session (743 once invoked), scanned A, original, MIT.

A publishing stage that uploads a validated machine-learning model package to GitHub, a code-hosting service, or Hugging Face, a platform for sharing models and datasets.

In plain words
What is it for?
Use it to publish complete source packages on GitHub or distribute prepared model files and libraries through Hugging Face.
Why use it?
It handles packaging and uploading the results after the model has been checked, so they do not have to publish files manually.

Skill for Codex

Written for Codex: installed under .codex/.

This is AXERA-TECH/Magnetar's own configuration. It tells Codex how to work on Magnetar itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything Magnetar configures →

Reuse

Borrowing it

Nothing to install: this file belongs to AXERA-TECH/Magnetar. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/AXERA-TECH/Magnetar/main/.codex/skills/magnetar/hidden/publish/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/AXERA-TECH/Magnetar

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for publish

README.md
[![agentmods](https://agentmods.dev/badge/skills/axera-tech/magnetar/publish/github.svg)](https://agentmods.dev/skills/axera-tech/magnetar/publish)
Your own site
<a href="https://agentmods.dev/skills/axera-tech/magnetar/publish"><img src="https://agentmods.dev/badge/skills/axera-tech/magnetar/publish/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for publish

Your own site · 80×15
<a href="https://agentmods.dev/skills/axera-tech/magnetar/publish"><img src="https://agentmods.dev/badge/skills/axera-tech/magnetar/publish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 31 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 743 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 1 finding, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Tool Misuse · line 44
    Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
    Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00031 $0.00743
Opus 5.5 $0.00012 $0.00297
Sonnet 5.5 $0.00006 $0.00149
Haiku 4.5 $0.00003 $0.00074

Measured 1mo ago against content hash c5b80f91ac39, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

publish scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.codex/skills/magnetar/hidden/publish/SKILL.md · 68 lines

What it actually says

PUBLISH

STOP 点——必须询问用户

进入本阶段时,暂停并向用户确认以下三项,缺一不可:

  1. 发布到哪里? GitHub / HuggingFace
  2. 仓库名叫什么?(默认 {model_name}-axmodel)
  3. 凭据在哪? GitHub 用 GITHUB_TOKEN 环境变量,HF 用 HF_TOKEN

执行

result = magnetar.stages.publish.publish(
    pkg=task_dir / "package",
    target="github",          # 或 "huggingface"
    repo_name="my-model-axmodel",
    token=None,               # None → 自动读 GITHUB_TOKEN / HF_TOKEN 环境变量
    org="AXERA-TECH",         # 可选,GitHub org 或 HF namespace
    model_name="my_model",
)

分发策略

平台 内容 理念
GitHub 完整包(含 model_convert/ + C++ 源码) 客户可复现编译流程
HuggingFace 精简包(models/ + python/ + cpp/ + reports/ + setup.sh + run.sh) 客户直接用预编译模型和库

HF 特殊处理

  • 剔除 model_convert/、.git、__pycache__(cpp/ 编译产物保留)
  • README.md 自动添加 YAML frontmatter(license、pipeline_tag、tags)
  • 上传到 HF model repo

GitHub 特殊处理

  • 在 package 目录内 git init + git push --force
  • 使用 https://oauth2:{token}@github.com/{org}/{repo}.git 认证

验证

  • GitHub:确认 push 成功,返回 repo URL
  • HF:确认 upload_folder 成功,返回 model URL
  • 端到端 NPU 跑通(RUNONBOARD 通过)时,发布包 SDK 为 NPU 专用版: 无 onnxruntime/torch/transformers 运行时回退,依赖仅 numpy + pyaxengine
  • 检查 package/NPU_ONLY_SDK.md 存在且 python/*_sdk/inference.py 无 import onnxruntime

LLM 分支(model_route=llm)

  • 发布内容以 axllm 模型目录(models/ 内 config.json + tokenizer + *.axmodel) 与 OpenAI 兼容 Python SDK(依赖仅 requests)为主;
  • GitHub:model_convert 含可复现 llm_build.sh(完整 llm_build2 命令);
  • HuggingFace:上传模型目录 + SDK + setup.sh/run.sh(含 axllm 安装脚本说明);
  • README frontmatter 的 pipeline_tag 用 text-generation。

失败处理

  • 凭据缺失 → 返回错误信息,重新询问用户
  • 推送/上传失败 → 返回错误详情,用户决定重试或跳过
  • huggingface_hub 未安装 → 提示 pip install -i https://mirrors.aliyun.com/pypi/simple/ huggingface_hub
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 68 lines · 31 tokens per session scan A c5b80f91ac39

Subscribe to this mod's changes

publish is a skill published in the GitHub repository AXERA-TECH/Magnetar (22 stars, last pushed 1mo ago), licensed MIT. It adds 31 tokens to every session and 743 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

release-announcement

Write a release announcement — changelog, blog post, in-app note, or social post — that leads with user impact, names the audience, and includes upgrade/migration steps without filler.

paperclipai/paperclip · 42 tokens

agent-framework-py-release

Use when cutting a Python release for the microsoft/agent-framework monorepo. Triggers on "bump py versions", "cut a python release", "prepare release PR for python", "release py packages", "bump python to X.Y.Z", or similar requests to bump Python package versions and prepare a release PR. Handles all four lifecycle…

microsoft/agent-framework · 103 tokens

changelog-scan

Scan merged PRs and commits since a given reference, extract titles, labels, types, and signals. Produces structured input for release notes drafting.

cobusgreyling/loop-engineering · 35 tokens

draft-release-notes

Turn changelog-scan output into polished, categorized release notes draft. Propose only.

cobusgreyling/loop-engineering · 23 tokens

release-notes

Create release notes for a new version tag. Gathers all commits, PRs, issues fixed, and breaking changes since a previous release. Creates the release notes markdown file, tags the repo, and pushes. Asks the user to confirm the base version to diff against.

agentic-community/mcp-gateway-registry · 59 tokens

create-milestone

Create a GitHub milestone for an upcoming release. Suggests the next version based on the latest release, gathers all merged PRs and closed issues since that release, presents a draft with two tables (Issues and PRs) for user approval, then creates the milestone and assigns all approved items.

agentic-community/mcp-gateway-registry · 64 tokens