A release procedure for Dash Platform, the software project this workflow targets. It updates package versions and the changelog, then opens a pull request for a maintainer to review and merge.

Use it when preparing stable or prerelease versions such as beta, release-candidate, or development releases. Publishing artifacts and creating the final tag happen after the pull request is merged.

It keeps version changes across JavaScript and Rust packages coordinated and records changes in the project's release notes.

release — Skill by dashpay

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/dashpay/platform/release

Any agent

npx skills add dashpay/platform --skill release

Clone the repo

git clone --depth 1 https://github.com/dashpay/platform

Made for: Claude Code, Codex.

Per session 61 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 4,157 The whole file, excluding the scripts and references it only reads on demand.

Security scan C 2 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00061	$0.04157
Opus 5	$0.00030	$0.02079
Sonnet 5	$0.00012	$0.00831
Haiku 4.5	$0.00006	$0.00416

Measured yesterday against content hash 3a77600450df, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

release scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

curl -s https://registry.npmjs.org/@dashevo/<pkg>/<version> | python3 -c "import sys,json;print(json.load(sys.stdin).get('_npmUser'))"

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -s https://registry.npmjs.org/@dashevo/<pkg>/<version> | python3 -c "import sys,json;print(json.load(sys.stdin).get('_npmUser'))"

.claude/skills/release/SKILL.md · 167 lines

How it starts

The opening of the file, as written. The whole thing — 167 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Cut a Platform release

yarn release (→ scripts/release/release.sh) bumps every workspace version, regenerates the changelog, and opens a release PR. It does not publish artifacts or tag — a maintainer merges the PR, then publishes a GitHub release, which creates the tag and triggers the asset build (see Publishing the GitHub release below).

Full flow: yarn release → fix offset versions on the PR → merge → publish the GitHub release (tags + builds assets).

What one run does

Bumps the version in all npm package.json files, the root package.json, and the [workspace.package] version in Cargo.toml (all Rust crates inherit it).
Runs cargo metadata to refresh Cargo.lock.
Regenerates CHANGELOG.md (conventional-changelog, dash preset) from the changelog-base tag to HEAD.
Creates branch release_<new-version>, commits chore(release): update changelog and version to <new-version>.
Pushes the branch and opens a PR against the branch you ran it from (e.g. v4.1-dev), body from scripts/release/pr_description.md, assigned to a milestone.

Command

yarn release -v=<target-version>     # explicit exact version — preferred, unambiguous
yarn release -t=<type>               # derive next version from current + type
yarn release -c=<tag>                # override the changelog-from tag (optional)

-v / --version — set the exact version (validated as semver). The type is inferred from the prerelease id. Prefer this — no guessing.
-t / --type — release, or a prerelease id: dev, alpha, beta, rc (any id works). Version is derived from the current version (see rules below).
-c / --changelog-from — tag to build the changelog from. Omit to auto-detect via find_latest_tag.js.

`-t` derivation rules (from `bump_version.js`, when `-v` is not given)

Given current root version and its type:

release → same type release: patch bump (4.0.0 → 4.0.1).
release → a prerelease type: minor bump + .1 (4.0.0 -t=beta → 4.1.0-beta.1).
prerelease → release: minor bump, drop prerelease (4.1.0-beta.3 -t=release → 4.1.0).
prerelease → different prerelease type: retarget X.Y.0-<newtype>.1 (4.1.0-dev.5 -t=beta → 4.1.0-beta.1).
prerelease → same prerelease type: prerelease bump (4.1.0-beta.1 -t=beta → 4.1.0-beta.2).

Read the full file on GitHub · 167 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 167 lines · 61 tokens per session scan C 3a77600450df

Subscribe to this mod's changes

release is a skill published in the GitHub repository dashpay/platform (92 stars, last pushed yesterday), licensed MIT. It adds 61 tokens to every session and 4,157 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review Git and workflow Productivity blockchain cryptocurrency dapp dapps dash decentralization

rtc-balance

Check RustChain wallet balance, epoch info, and network status via the public RPC.

Scottcjn/Rustchain · 20 tokens

frontend-design

Create distinctive, production-grade Stellar dApp UI. Combines bold aesthetic direction with smart contract integration patterns — wallet connection flows, transaction UX, contract data displays, and agentic kit hook wiring. No generic "AI slop" aesthetics.

rylsherdamz-rgb/stellar-forge · 51 tokens

stellar-mcp

MCP (Model Context Protocol) tools for Stellar development. Gives Claude direct access to the Stellar blockchain, filesystem, GitHub, and Playwright through configured MCP servers. Use when querying chain data, deploying contracts, managing repos, or running e2e tests from within the agent.

rylsherdamz-rgb/stellar-forge · 61 tokens

dero

Query the DERO privacy blockchain and its documentation through the dero-mcp-server. Use for any DERO ecosystem question — node setup, smart contracts (DVM-BASIC), wallets, TELA apps, RPC methods, ports, privacy mechanics, transaction tracing, contract inspection.

DHEBP/dero-mcp-server · 59 tokens

local-network

Run isolated local Convex networks and in-process lattice node networks for development. Use when testing against local peers, reproducing peer or P2P replication issues, exercising NodeServer or P2PNode sync, or when no remote network is configured.

Convex-Dev/convex · 53 tokens

protocol-versions

Protocol versions, migrations and the v1 upgrade — which semantics to write against, and how to change CVM behaviour without forking the network. Use when changing core functions, juice costs, encodings or on-chain libraries.

Convex-Dev/convex · 49 tokens

release