Archon: Skill for Claude Code

.claude/skills/release/SKILL.md

release is a skill for Claude Code from coleam00/Archon. It costs 93 tokens per session (10,419 once invoked), scanned C, original, MIT.

A release workflow that compares a development branch with the main branch, prepares changelog entries, updates the version, and opens a pull request.

In plain words
What is it for?
Use it for patch, minor, or major releases, then update package checksums and verify the installation path after builds finish.
Why use it?
It organizes the steps needed to publish a software release and reduces mistakes in version and package updates.

Skill for Claude Code

Written for Claude Code: installed under .claude/. Also seen: positional $N argument; mentions Codex.

This is coleam00/Archon's own configuration. It tells Claude Code how to work on Archon itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything Archon configures →

About the project

Archon is a workflow engine for AI coding agents that turns development processes into YAML-defined sequences with phases, validation gates, and artifacts. Developers use it to run repeatable processes such as planning, implementation, testing, code review, and pull-request creation across projects. The catalogue entries provide commands, agents, skills, hooks, instructions, and settings for working with Archon.

coleam00/Archon · 23,752 stars · on GitHub · archon.diy

Reuse

Borrowing it

Nothing to install: this file belongs to coleam00/Archon. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/coleam00/Archon/dev/.claude/skills/release/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/coleam00/Archon

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for release

README.md
[![agentmods](https://agentmods.dev/badge/skills/coleam00/archon/release/github.svg)](https://agentmods.dev/skills/coleam00/archon/release)
Your own site
<a href="https://agentmods.dev/skills/coleam00/archon/release"><img src="https://agentmods.dev/badge/skills/coleam00/archon/release/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for release

Your own site · 80×15
<a href="https://agentmods.dev/skills/coleam00/archon/release"><img src="https://agentmods.dev/badge/skills/coleam00/archon/release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 93 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 10,419 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 2 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Tool Misuse · line 383
    Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
    Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
  • high Tool Misuse · line 389
    Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
    Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00093 $0.10419
Opus 5.5 $0.00037 $0.04168
Sonnet 5.5 $0.00019 $0.02084
Haiku 4.5 $0.00009 $0.01042

Measured 5d ago against content hash 6ab193aac845, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

release scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

rm -rf "$TMP_DIR"

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

Also run `/test-release curl-mac x.y.z` to cover the curl install path. The two install paths test slightly different things (Homebrew tests the tap formula, curl tests `install.sh` and checksums from the release) and bo
.claude/skills/release/SKILL.md · 848 lines

How it starts

The opening of the file, as written. The whole thing — 848 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Release Skill

Creates a release by comparing dev to main, generating changelog entries from commits, bumping the version, and creating a PR. After the tag is pushed and the release workflow finishes building binaries, updates the Homebrew formula with the real SHA256 values from the published checksums.txt, syncs the coleam00/homebrew-archon tap, and verifies the end-to-end install path via /test-release.

⚠️ CRITICAL — Homebrew formula SHAs cannot be known until after the release workflow builds binaries.

The version field in homebrew/archon.rb and the sha256 fields must be updated atomically. Never update one without the other.

The correct sequence is:

  1. Tag is pushed → release workflow fires → binaries built → checksums.txt uploaded
  2. Fetch checksums.txt from the published release
  3. Parse the SHA256 per platform
  4. Update homebrew/archon.rb with the new version AND the new SHAs in a single commit
  5. Sync to the coleam00/homebrew-archon/Formula/archon.rb tap repo

Updating the formula's version field without also updating the sha256 values creates a stale, misleading formula that looks valid but produces checksum mismatches on install. This has happened before (v0.3.0: version updated to 0.3.0 but SHAs were still from v0.2.13). Always do both or neither.

Process

Step 1: Validate State

# Must be on dev branch with clean working tree
git checkout dev
git pull origin dev --no-rebase
git status --porcelain  # must be empty
git fetch origin main

If not on dev or working tree is dirty, abort with a clear message.

Then check that dev actually contains main. Anything committed directly to main — a docs typo fix, a hotfix, the previous release's formula commit — stays stranded there until someone merges it back. The release PR would then propose reverting it, and the next release inherits the drift.

if git merge-base --is-ancestor origin/main origin/dev; then
  echo "dev contains main — OK"
else
  echo "DRIFT: commits exist on main that dev does not have:"
  git log origin/dev..origin/main --oneline
  echo ""
  echo "Resync before releasing:"
  echo "  git checkout dev && git pull origin main --no-rebase && git push origin dev"
  exit 1
fi

Read the full file on GitHub · 848 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago Changed · +24 lines 6ab193aac845
  2. 7d ago Changed 09b04234e567
  3. 16d ago Changed · +17 lines c01c65cac6cf
  4. 19d ago Changed 2a8f4eba1170
  5. 27d ago Changed · +18 lines dab19a35bf54
  6. 1mo ago Changed 1d637a5bb13f
  7. 1mo ago Changed 706912a9aa08
  8. 1mo ago First seen · 789 lines · 93 tokens per session scan C b7c78eb53801

Subscribe to this mod's changes

release is a skill published in the GitHub repository coleam00/Archon (23,752 stars, last pushed today), licensed MIT. It adds 93 tokens to every session and 10,419 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

commit-pr

Mandatory Codex/Copilot publication adapter for opencode-swarm. Use for every GitHub issue assignment that results in code changes, commits, pushes, draft PRs, PR body edits, PR readying, release notes, or CI closeout. Must be loaded before git push, gh pr create, gh pr edit, or gh pr ready. Routes to the single…

ZaxbyHub/opencode-swarm · 100 tokens

contributing

Codex adapter for the opencode-swarm contribution checklist. Use when preparing user-visible changes, release note fragments, local validation, branch hygiene, PR checklist items, or contribution-policy compliance before publishing work.

ZaxbyHub/opencode-swarm · 44 tokens

hatch3r-release

Cuts a release with version bump, changelog, tagging, and deploy verification. Use when preparing a release, cutting a version, or deploying to production.

hatch3r/hatch3r · 37 tokens

hatch3r-cli-gh

GitHub CLI — repos, issues, PRs, releases, gists. Use when drafting GitHub pull requests, issues, releases, gists, or workflow dispatches; invoke gh. Authenticates via the platform's native token mechanism (OAuth / PAT).

hatch3r/hatch3r · 62 tokens

changelog

Generate a single unified changelog from git history that works for everyone in the company (managers and non-tech colleagues as well as developers). Outputs Slack mrkdwn so it can be pasted straight into Slack. Defaults to Slovak (English only on explicit request) and to comparing the release branch (main) against…

samuelpatro/.claude · 105 tokens

sc:deploy-remote

Deploy / sync the current LOCAL workspace to its linked REMOTE host over SSH, and manage that remote (create dirs, run commands, restart services) — all from the local workspace. Use when the user asks to deploy, push to production, sync to the server/remote, ship, release, or "handle the remote". Reads the…

squadcodercom/squadcoder · 148 tokens