Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/destrayon/connapse/release-gatekeepernpx skills add Destrayon/Connapse --skill release-gatekeepergit clone --depth 1 https://github.com/Destrayon/ConnapseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/destrayon/connapse/release-gatekeeper)<a href="https://agentmods.dev/skills/destrayon/connapse/release-gatekeeper"><img src="https://agentmods.dev/badge/skills/destrayon/connapse/release-gatekeeper.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00183 | $0.05954 |
| Opus 5 | $0.00092 | $0.02977 |
| Sonnet 5 | $0.00037 | $0.01191 |
| Haiku 4.5 | $0.00018 | $0.00595 |
Grade A, and why
release-gatekeeper scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLlowData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -X POST "$URL" -H "Content-Type: application/json" --data-raw "{\"name\":\"test\"}" Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
description: "End-to-end release validation for Connapse — the 'final boss' before any version ships. Downloads the latest alpha from GitHub Releases, deploys an isolated Docker instance (separate from production), then How it starts
The opening of the file, as written. The whole thing — 451 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Release Gatekeeper
You are the final authority on whether a Connapse release is ready to ship. Your job is to be thorough, skeptical, and evidence-driven. You are an adversary, not a validator — your primary goal is to find bugs, not confirm things work.
Philosophy
A release is guilty until proven innocent. Every feature claim must be verified with actual evidence. If something doesn't work, you document it as a failure. Your release decision carries real weight, so be honest.
The mutation testing mindset: For every positive test ("container create returns 201"), add a negative counterpart. Ask yourself: "Would this test pass on a completely broken server that returns 200 for everything?" If yes, the test is worthless — add assertions that verify the response body contains the expected data, that different inputs produce different outputs, and that invalid inputs are rejected.
Evidence, not status codes: Every test must capture the actual HTTP response body (or screenshot, or CLI output) as proof. Never conclude a test passed based solely on a status code. Log the response, verify specific fields, cross-validate with a separate query.
Default to FAIL on ambiguity: If a test result is unclear, mark it as FAIL and flag it for human review. It's safer to raise a false alarm than to miss a real bug.
Three possible verdicts:
- SHIP IT — All critical paths pass, no security issues, no data integrity issues, overall score >= 85%
- SHIP WITH KNOWN ISSUES — Minor issues documented, no blockers, score >= 75%
- DO NOT SHIP — Critical failures, security holes, data loss risks, or score < 75%
Critical Lessons from Past Runs
These are hard-won lessons from 3 live test runs. Violating any of them will produce false failures and waste time.
1. Discover API endpoints before testing — don't hardcode paths
Connapse has TWO auth models and TWO endpoint path conventions:
- Cookie auth (Blazor Server) — The UI uses cookie-based auth. There is NO REST
POST /api/v1/auth/loginor/api/v1/auth/tokenendpoint. JWT login is Blazor-internal. - PAT auth (X-Api-Key header) — The only scriptable auth. Create a PAT via the admin UI or use the seeded admin's PAT.
- Versioned endpoints (
/api/v1/agents,/api/v1/auth/pats) — Auth and agents use v1 prefix. - Unversioned endpoints (
/api/containers,/api/settings) — Containers, files, search, settings have no version prefix.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 451 lines · 183 tokens per session scan A 1f338fc8f9e2
release-gatekeeper is a skill published in the GitHub repository Destrayon/Connapse (16 stars, last pushed yesterday), licensed MIT. It adds 183 tokens to every session and 5,954 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
blazorbindings-maui-third-party
Integrate third-party .NET MAUI control libraries into BlazorBindings.Maui apps by generating Razor wrappers, registering attached properties, and bridging to native elements for imperative APIs such as popups or bottom sheets. Use when adding, updating, or troubleshooting a MAUI control package in a…
cocosearch-add-language
Use when adding support for a new programming language or config format to CocoSearch. Guides through all paths (handler, symbol extraction, context expansion) with registration checklists. For grammar handlers, use cocosearch-add-grammar.
cocosearch-add-extractor
Use when adding a dependency extractor for a language or grammar. Guides through pre-checks, extractor implementation, optional module resolver, tests, and registration. Enables deps tree, deps impact, and dependency-enriched search for the target language.
cocosearch-add-grammar
Use when adding a grammar handler for domain-specific file formats that share a base language extension (e.g., GitHub Actions within YAML). Guides through YamlGrammarBase inheritance, content validation, separator spec, metadata extraction, tests, and registration.
clawmem
ClawMem operational reference for agents at query time — the 3-rule escalation gate, MCP tool routing, the 4 query-optimization levers, pipeline behavior (query vs intentsearch), composite scoring, and memory lifecycle (pin/snooze/forget). Use when tuning retrieval, troubleshooting recall quality, or any ClawMem…
cocosearch-quickstart
Use when setting up CocoSearch for the first time or indexing a new project. Guides through infrastructure check, indexing, and verification in under 2 minutes.