Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bex-co/bex/releasenpx skills add bex-co/bex --skill releasegit clone --depth 1 https://github.com/bex-co/bexWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00072 | $0.01088 |
| Opus 5 | $0.00036 | $0.00544 |
| Sonnet 5 | $0.00014 | $0.00218 |
| Haiku 4.5 | $0.00007 | $0.00109 |
Grade A, and why
release scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
allowed-tools: Bash(git:*), Bash(gh:*), Bash(cosign:*), Bash(brew:*), Bash(scripts/install-bex.sh:*), Bash(curl:*), AskUserQuestion How it starts
The opening of the file, as written. The whole thing — 50 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Task: Release a bex component
/release <component> [patch|minor|major|X.Y.Z] — component today: cli (tag prefix bex-cli/v). platform is reserved for the ADR058 bex/v* train and must be rejected until that exists.
Invariant (ADR058): code flows into main only through /ship; versions exist only as tags minted here. This skill never commits, never touches the working tree, and never re-uses or moves an existing tag. A pushed tag is a public, immutable release.
Step 1 — Preconditions (all must hold; stop with a clear message otherwise)
- Working tree clean (
git status --porcelainempty) and current branchmain. HEAD == origin/mainaftergit fetch origin main— releases are cut only from shipped code.- CI for HEAD is green:
gh run list --commit $(git rev-parse HEAD)shows no failed/in-progress required runs. If runs are still in progress, wait for them.
Step 2 — Determine the version
- Last tag: highest existing
bex-cli/v*by semver (git tag -l 'bex-cli/v*'; alsogit fetch --tagsfirst). No tags yet ⇒ this is the first release; default0.1.0unless an explicit version was given. - List commits since that tag touching the component's paths — for
cli:lego/cli/**,scripts/bex-cli-*,scripts/install-bex*,.github/workflows/cli-release.yml. If there are none, say so and stop (nothing to release) unless the user explicitly insists. - Suggested bump from Conventional Commits over those commits: any
!/BREAKING CHANGE→ major (while on0.x, propose minor instead and say why), else anyfeat→ minor, else patch. - If the user passed a level or exact version, that wins. Otherwise present the suggestion plus the commit list and ask for confirmation (
AskUserQuestion) — the confirmed version is the authorization to publish.
Step 3 — Tag and push
git tag -a "bex-cli/vX.Y.Z" -m "bex CLI vX.Y.Z"
git push origin "bex-cli/vX.Y.Z"
Step 4 — Watch the release workflow to green
The tag triggers release (bex CLI) (cli-release.yml). Watch it like /ship watches deploys (gh run watch <id> --exit-status); rerun genuine infra flakes (max 2). If it fails on a real defect: do not delete or move the tag. Diagnose, report, get the fix landed via /ship, then cut the next patch version here. If the failure happened before the GitHub release was created, deleting the never-published tag is permitted with user confirmation.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 50 lines · 0 tokens per session scan A 7eef6e6326a6
release is a skill published in the GitHub repository bex-co/bex (420 stars, last pushed 3d ago), licensed Apache-2.0. It adds 72 tokens to every session and 1,088 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cut-release
Cut (publish) a release of meshery/meshery by publishing the current Release Drafter draft. Use this whenever the user asks to "cut a release", "publish the release", "ship a release", "release meshery", "do a release", "release the latest merge", or wants recently merged PRs to go out to users. Handles waiting for…
gh-axi
Operate GitHub through the gh-axi CLI - issues, pull requests, workflow runs, workflows, releases, repositories, labels, Projects (v2), Actions secrets and variables, search, and raw API access. Use whenever a task touches GitHub: listing or filing issues, reviewing or merging PRs, checking CI runs, triggering…
superplane-changelog
When generating a SuperPlane changelog from merged commits. Use for "what's new" summaries with new integrations, new components/triggers, improvements, security updates, and bug fixes. Output is user-focused markdown in tmp/.
ship-release
Drive a Telepresence release from a prepared branch all the way through CI, docs, the Releases workflow, and PR merges. Assumes make prepare-release has already been run locally and the branch with that commit was pushed and a PR opened. Use when the user says "ship the release", or "complete the release". User-only.
openspec-archive-change
Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
changelog-entry
Add a new entry to CHANGELOG.yml under the current unreleased version (or create the version block if needed), then regenerate documentation. Use when the user says things like "add a changelog entry", "log this fix in the changelog", or "/changelog-entry".