Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bradygaster/squad/release-processnpx skills add bradygaster/squad --skill release-processgit clone --depth 1 https://github.com/bradygaster/squadWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00027 | $0.05247 |
| Opus 5 | $0.00014 | $0.02624 |
| Sonnet 5 | $0.00005 | $0.01049 |
| Haiku 4.5 | $0.00003 | $0.00525 |
Grade C, and why
release-process scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf /tmp/squad-release-test How it starts
The opening of the file, as written. The whole thing — 550 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Context
This is the definitive release runbook for Squad. Born from the v0.8.22 release disaster (4-part semver mangled by npm, draft release never triggered publish, wrong NPM_TOKEN type, 6+ hours of broken latest dist-tag) and hardened by v0.9.4 lessons (root package.json drift, CHANGELOG validation, GITHUB_TOKEN propagation limitation — PRs #1042, #1043, #1044).
See also: .squad/skills/release-process/SKILL.md for the team-level skill with full incident history.
Rule: No agent releases Squad without following this checklist. No exceptions. No improvisation.
Pre-Release Validation
Before starting ANY release work, validate the following:
1. Version Number Validation
Rule: Only 3-part semver (major.minor.patch) or prerelease (major.minor.patch-tag.N) are valid. 4-part versions (0.8.21.4) are NOT valid semver and npm will mangle them.
# Check version is valid semver
node -p "require('semver').valid('0.8.22')"
# Output: '0.8.22' = valid
# Output: null = INVALID, STOP
# For prerelease versions
node -p "require('semver').valid('0.8.23-preview.1')"
# Output: '0.8.23-preview.1' = valid
If semver.valid() returns null: STOP. Fix the version. Do NOT proceed.
2. NPM_TOKEN Verification
Rule: NPM_TOKEN must be an Automation token (no 2FA required). User tokens with 2FA will fail in CI with EOTP errors.
# Check token type (requires npm CLI authenticated)
npm token list
Look for:
- ✅
read-writetokens with NO 2FA requirement = Automation token (correct) - ❌ Tokens requiring OTP = User token (WRONG, will fail in CI)
How to create an Automation token:
- Go to npmjs.com → Settings → Access Tokens
- Click "Generate New Token"
- Select "Automation" (NOT "Publish")
- Copy token and save as GitHub secret:
NPM_TOKEN
If using a User token: STOP. Create an Automation token first.
3. Branch and Tag State
Rule: Release from main branch. Ensure clean state, no uncommitted changes, latest from origin.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 550 lines · 27 tokens per session scan C 6ab7149444ec
release-process is a skill published in the GitHub repository bradygaster/squad (3,140 stars, last pushed 2d ago), licensed MIT. It adds 27 tokens to every session and 5,247 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
coding-agents-farm
To orchestrate parallel coding-agent farms (Claude, Codex, Copilot, Gemini, etc.) on isolated git worktrees.
clean-architecture-dotnet
Use when domain logic leaks into API/Infrastructure, project references violate layer boundaries, or you need to decide between CQS (always), CQRS bus (complex domains), and DDD patterns (invariants and events).
mutation-testing
Use when running mutation testing, killing mutants, verifying test quality, checking mutation score, or analyzing survivors after the test baseline is green.
generate-microcks-openapi-samples
Use when creating OpenAPI mock examples for Microcks, setting up request/response routing with dispatchers, or mapping request fields to mock responses.
outside-in-tdd
Use when writing tests from the outside-in, defining behavior before code, or any feature where tests should start from observable business behavior and let internal design emerge.
extracting-code-structure
Use when listing all methods, functions, or classes in a file, exploring unfamiliar code, getting API overviews, or deciding what to read selectively without loading entire files.