Archon is a workflow engine for AI coding agents that turns development processes into YAML-defined sequences with phases, validation gates, and artifacts. Developers use it to run repeatable processes such as planning, implementation, testing, code review, and pull-request creation across projects. The catalogue entries provide commands, agents, skills, hooks, instructions, and settings for working with Archon.
Borrowing it
Nothing to install: this file belongs to coleam00/Archon. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/coleam00/Archon/dev/.claude/skills/release/SKILL.mdgit clone --depth 1 https://github.com/coleam00/ArchonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/coleam00/archon/release)<a href="https://agentmods.dev/skills/coleam00/archon/release"><img src="https://agentmods.dev/badge/skills/coleam00/archon/release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/coleam00/archon/release"><img src="https://agentmods.dev/badge/skills/coleam00/archon/release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 383 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 389 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00093 | $0.10419 |
| Opus 5.5 | $0.00037 | $0.04168 |
| Sonnet 5.5 | $0.00019 | $0.02084 |
| Haiku 4.5 | $0.00009 | $0.01042 |
Grade C, and why
release scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$TMP_DIR" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Also run `/test-release curl-mac x.y.z` to cover the curl install path. The two install paths test slightly different things (Homebrew tests the tap formula, curl tests `install.sh` and checksums from the release) and bo How it starts
The opening of the file, as written. The whole thing — 848 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Release Skill
Creates a release by comparing dev to main, generating changelog entries from commits, bumping the version, and creating a PR. After the tag is pushed and the release workflow finishes building binaries, updates the Homebrew formula with the real SHA256 values from the published checksums.txt, syncs the coleam00/homebrew-archon tap, and verifies the end-to-end install path via /test-release.
⚠️ CRITICAL — Homebrew formula SHAs cannot be known until after the release workflow builds binaries.
The
versionfield inhomebrew/archon.rband thesha256fields must be updated atomically. Never update one without the other.The correct sequence is:
- Tag is pushed → release workflow fires → binaries built →
checksums.txtuploaded- Fetch
checksums.txtfrom the published release- Parse the SHA256 per platform
- Update
homebrew/archon.rbwith the new version AND the new SHAs in a single commit- Sync to the
coleam00/homebrew-archon/Formula/archon.rbtap repoUpdating the formula's
versionfield without also updating thesha256values creates a stale, misleading formula that looks valid but produces checksum mismatches on install. This has happened before (v0.3.0: version updated to 0.3.0 but SHAs were still from v0.2.13). Always do both or neither.
Process
Step 1: Validate State
# Must be on dev branch with clean working tree
git checkout dev
git pull origin dev --no-rebase
git status --porcelain # must be empty
git fetch origin main
If not on dev or working tree is dirty, abort with a clear message.
Then check that dev actually contains main. Anything committed directly to main — a docs typo fix, a hotfix, the previous release's formula commit — stays stranded there until someone merges it back. The release PR would then propose reverting it, and the next release inherits the drift.
if git merge-base --is-ancestor origin/main origin/dev; then
echo "dev contains main — OK"
else
echo "DRIFT: commits exist on main that dev does not have:"
git log origin/dev..origin/main --oneline
echo ""
echo "Resync before releasing:"
echo " git checkout dev && git pull origin main --no-rebase && git push origin dev"
exit 1
fi
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +24 lines 6ab193aac845
- 7d ago Changed 09b04234e567
- 16d ago Changed · +17 lines c01c65cac6cf
- 19d ago Changed 2a8f4eba1170
- 27d ago Changed · +18 lines dab19a35bf54
- 1mo ago Changed 1d637a5bb13f
- 1mo ago Changed 706912a9aa08
- 1mo ago First seen · 789 lines · 93 tokens per session scan C b7c78eb53801
release is a skill published in the GitHub repository coleam00/Archon (23,752 stars, last pushed today), licensed MIT. It adds 93 tokens to every session and 10,419 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
commit-pr
Mandatory Codex/Copilot publication adapter for opencode-swarm. Use for every GitHub issue assignment that results in code changes, commits, pushes, draft PRs, PR body edits, PR readying, release notes, or CI closeout. Must be loaded before git push, gh pr create, gh pr edit, or gh pr ready. Routes to the single…
contributing
Codex adapter for the opencode-swarm contribution checklist. Use when preparing user-visible changes, release note fragments, local validation, branch hygiene, PR checklist items, or contribution-policy compliance before publishing work.
hatch3r-release
Cuts a release with version bump, changelog, tagging, and deploy verification. Use when preparing a release, cutting a version, or deploying to production.
hatch3r-cli-gh
GitHub CLI — repos, issues, PRs, releases, gists. Use when drafting GitHub pull requests, issues, releases, gists, or workflow dispatches; invoke gh. Authenticates via the platform's native token mechanism (OAuth / PAT).
changelog
Generate a single unified changelog from git history that works for everyone in the company (managers and non-tech colleagues as well as developers). Outputs Slack mrkdwn so it can be pasted straight into Slack. Defaults to Slovak (English only on explicit request) and to comparing the release branch (main) against…
sc:deploy-remote
Deploy / sync the current LOCAL workspace to its linked REMOTE host over SSH, and manage that remote (create dirs, run commands, restart services) — all from the local workspace. Use when the user asks to deploy, push to production, sync to the server/remote, ship, release, or "handle the remote". Reads the…