Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/d-oit/rust-2026-template/release-rustnpx skills add d-oit/rust-2026-template --skill release-rustgit clone --depth 1 https://github.com/d-oit/rust-2026-templateWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00068 | $0.00888 |
| Opus 5 | $0.00034 | $0.00444 |
| Sonnet 5 | $0.00014 | $0.00178 |
| Haiku 4.5 | $0.00007 | $0.00089 |
Grade C, and why
release-rust scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -s https://crates.io/api/v1/crates/<your-crate-name> | python3 -m json.tool | grep '"name"' Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s https://crates.io/api/v1/crates/<your-crate-name> | python3 -m json.tool | grep '"name"' How it starts
The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: release-rust
When to Use
- User asks for this skill's functionality
Purpose
Create and publish a new release of the Rust project.
Prerequisites
- All CI checks pass on main
CHANGELOG.mdupdatedcargo-distinstalled
Steps
0. Verify crate name availability on crates.io (FIRST TIME PUBLISH ONLY)
Before the very first publish, confirm the crate name is not already taken:
# Check via cargo search
cargo search <your-crate-name>
# Or via API (404 = available, 200 = taken)
curl -s https://crates.io/api/v1/crates/<your-crate-name> | python3 -m json.tool | grep '"name"'
# Or open in browser: https://crates.io/crates/<your-crate-name>
See
.agents/skills/crates-io-name-check/SKILL.mdfor full naming guidance and best practices.
Do not proceed with publishing if the name is taken — choose a unique name first.
1. Pre-release checks
cargo fmt --all -- --check
cargo clippy --all-targets --all-features -- -D warnings
cargo nextest run --all-features
cargo audit && cargo deny check
2. Bump version in Cargo.toml
cargo update --workspace
3. Commit and tag
git add Cargo.toml Cargo.lock CHANGELOG.md
git commit -m "chore: release vX.Y.Z"
git tag -a vX.Y.Z -m "Release vX.Y.Z"
git push origin main --tags
4. GitHub Release via CI
Pushing a tag triggers .github/workflows/release.yml:
- Builds binaries for all targets
- Creates GitHub Release with assets
- Optionally publishes to crates.io
Version Scheme
MAJOR.MINOR.PATCH(Semantic Versioning)- Breaking = MAJOR, features = MINOR, fixes = PATCH
Success Criteria
- Tag on GitHub
- Release with binaries created
- CHANGELOG updated
- Crate name verified unique on crates.io (first publish)
Rationalizations
| Rationalization | Reality |
|---|---|
| "I'll skip the pre-release checks to save time." | Publishing broken code breaks downstream users. Always run the full check suite. |
| "The changelog can be updated after release." | Users read the changelog to understand what changed. Update it before tagging. |
| "I'll just push the tag directly." | Use git tag -a with a message. Tags without messages are unhelpful in history. |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 129 lines · 68 tokens per session scan C 4a3c1bb16877
release-rust is a skill published in the GitHub repository d-oit/rust-2026-template (10 stars, last pushed 3d ago), licensed MIT. It adds 68 tokens to every session and 888 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
review-backend
Performs a strict code review of Rust backend code (files, diffs, or snippets). Trigger whenever the user shares backend code (Rust, SQL) and asks for a review, feedback, or says "review this" — including partial snippets.
yada-yada-yada
Enter Seinfeld Mode. Explain programming, debugging, architecture, and code reviews through observational comedy inspired by Seinfeld. Trigger when the user says "what's the deal", festivus, serenity, yada, soup, shrinkage, sponge-worthy, master of my domain, double dip, newman, vandelay, nostrand, constanza or…
fix-issue
Fixes a bug, implements a missing feature, or implements one slice of a larger feature, starting from a GitHub issue link, number, or direct text description. Trigger when the user gives a GitHub issue URL/reference/description and asks to fix, implement, resolve, or work on it.
review-frontend
Performs a strict code review of the Svelte 5 frontend code (files, diffs, or snippets). Trigger whenever the user shares frontend code (Svelte, TypeScript, CSS) and asks for a review, feedback, or says "review this" — including partial snippets.
make-it-so
Enter Star Trek command mode. Use Star Trek terminology naturally while remaining a highly competent engineering officer. Trigger when the user mentions Star Trek, Picard, make it so, engage, stardate, number one, federation, borg, warp, enterprise.
triage-review-finding
Verifies and triages a code review finding (from an AI review, audit doc, or human reviewer) against the actual codebase. Trigger when the user pastes a review comment/finding and asks to check, analyze, or evaluate whether it makes sense.