Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/builderced/agent-skills/skill-lifecycle-managementnpx skills add BuilderCed/agent-skills --skill skill-lifecycle-managementgit clone --depth 1 https://github.com/BuilderCed/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/builderced/agent-skills/skill-lifecycle-management)<a href="https://agentmods.dev/skills/builderced/agent-skills/skill-lifecycle-management"><img src="https://agentmods.dev/badge/skills/builderced/agent-skills/skill-lifecycle-management.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00029 | $0.00862 |
| Opus 5 | $0.00015 | $0.00431 |
| Sonnet 5 | $0.00006 | $0.00172 |
| Haiku 4.5 | $0.00003 | $0.00086 |
Grade A, and why
skill-lifecycle-management scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Lifecycle Management
When to Use
- Publishing a new skill to a registry
- Updating a skill after regulatory or API changes
- Deciding whether to deprecate or archive a skill
- Setting up freshness monitoring
- Reviewing skill quality over time
Lifecycle Stages
Draft → Review → Published → Maintained → Stale → Deprecated → Archived
| Stage | Duration | Actions |
|---|---|---|
| Draft | Days | Write, test locally, self-review |
| Review | Days | PR review, CI lint, security scan |
| Published | Indefinite | Available for installation |
| Maintained | Ongoing | Respond to issues, update for changes |
| Stale | >90 days no update | Flag [STALE], prioritize review |
| Deprecated | Announced | Mark deprecated, point to replacement |
| Archived | Final | Read-only, no longer maintained |
Versioning (SemVer)
MAJOR.MINOR.PATCH
MAJOR: Breaking changes (renamed fields, removed sections, new required dependencies)
MINOR: New content (added steps, new references, expanded coverage)
PATCH: Fixes (typos, URL updates, date corrections)
Examples:
1.0.0 → 1.0.1: Fixed broken URL in references1.0.1 → 1.1.0: Added new section on DORA RTS1.1.0 → 2.0.0: Restructured skill, changed frontmatter fields
Freshness Rules
| Age | Status | Action |
|---|---|---|
| < 30 days | Fresh | No action |
| 30-60 days | OK | Review if regulatory |
| 60-90 days | Review needed | Check update_sources |
| > 90 days | [STALE] | Mandatory review before use |
Regulatory skills: Review whenever source legislation changes, regardless of age.
Changelog Format
## [1.1.0] - 2026-04-17
### Added
- Section on DORA RTS Level 2 requirements
- Reference to new EDPB DPIA template (April 2026)
### Changed
- Updated e-invoicing timeline (September 2026 confirmed)
### Fixed
- Corrected NIS2 transposition deadline
Deprecation Process
- Announce: Add
deprecated: trueto frontmatter + reason - Point: Reference replacement skill in description
- Grace period: Keep available for 90 days
- Archive: Move to
skills/_archived/directory
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 110 lines · 29 tokens per session scan A d356d7bb6df8
skill-lifecycle-management is a skill published in the GitHub repository BuilderCed/agent-skills (2 stars, last pushed 4mo ago), licensed MIT. It adds 29 tokens to every session and 862 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
achieving-cmmc-level-2-compliance
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when…
escalation-governance
Assess whether to escalate models. Use when evaluating reasoning depth.
implementing-iso-27001-information-security-management
ISO/IEC 27001:2022 is the international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). This skill covers the complete.
agt-policy-authoring
Create and validate a minimal AGT Copilot CLI policy tailored to the repository being inspected.
silicon-throne
硅基圣座总控核心，以神谕式统御把零散任务压成 末将-first 之文明工程.
wallet-cli
Operate the TypeScript TRON wallet CLI for accounts, transfers, staking, governance, contracts, signing, chain queries, and password input with wallet-cli 4.12.0. Refuse wallet passwords in argv and require the supported stdin channel. For Java REPL requests, refuse that entry and offer the TypeScript one-shot CLI…