Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dinhanhthi/coding-friend --skill cf-ship-customgit clone --depth 1 https://github.com/dinhanhthi/coding-friendWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dinhanhthi/coding-friend/cf-ship-custom)<a href="https://agentmods.dev/skills/dinhanhthi/coding-friend/cf-ship-custom"><img src="https://agentmods.dev/badge/skills/dinhanhthi/coding-friend/cf-ship-custom.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.02903 |
| Opus 5 | $0.00000 | $0.01452 |
| Sonnet 5 | $0.00000 | $0.00581 |
| Haiku 4.5 | $0.00000 | $0.00290 |
Grade A, and why
cf-ship-custom scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 168 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Before
This is a version bump + ship + release operation. Run these steps BEFORE the standard cf-ship workflow.
Args (optional): [patch|minor|major] [plugin|cli]
Step B1: Get bump context
Run this ALWAYS — even when the working tree is clean. A clean working tree means changes are already committed and pushed; it does NOT mean there is nothing to release. Tags may not yet exist for the current file versions.
bash .coding-friend/skills/cf-ship-custom/scripts/bump-info.sh [package-arg] [level-arg]
Read the output. It tells you: which packages changed, current vs tag version, whether to bump or just update changelog, and path→package mapping.
Step B2: Determine bump level and filter packages
If level not in args, analyze the changes and determine patch/minor/major automatically. Do NOT ask for confirmation — proceed immediately.
Bump level taxonomy — match changelog labels:
- PATCH (x.x.Z): improvements or refinements to existing behavior (expanding allow-lists, tweaking output, polishing UX, bug fixes, typos, docs) — changelog label "Improved" or "Fixed". Example: expanding
auto-approveallow-list → PATCH, not MINOR. - MINOR (x.Y.0): new capability a user can invoke or opt into — new skill, new CLI command, new hook, new feature flag — changelog label "Added" or "New".
- MAJOR (X.0.0): breaking change (config format change, removed skill, changed CLI behavior).
Default to PATCH. Bias strongly toward PATCH over MINOR.
- When in doubt between PATCH and MINOR, choose PATCH.
- A single new capability alongside improvements → still PATCH unless the new capability is substantial and user-facing on its own.
- MINOR is reserved for releases where new capabilities are the dominant story — multiple new skills, commands, or features added, not just one incidental addition alongside fixes.
- Small additions that extend existing behavior (new option to an existing command, new entry in an existing list, new config key for an existing feature) → PATCH, not MINOR.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 168 lines · 0 tokens per session scan A bba3fa0f5da1
cf-ship-custom is a skill published in the GitHub repository dinhanhthi/coding-friend (3 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,903 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
skillshare-changelog
Generate CHANGELOG.md entry from recent commits in conventional format. Also syncs the website changelog page. Use this skill whenever the user asks to: generate a changelog, document what changed between tags, or create a new CHANGELOG entry. If you see requests like "write the changelog for v0.17", "what changed…
skillshare-release
End-to-end release workflow for skillshare. Runs tests, generates changelog (via /changelog), optionally writes local RELEASENOTES, updates version numbers, commits, and drafts announcements. Use when the user says "release", "prepare release", "cut a release", "release v0.19", or any request to publish a new version.…
release-manager
Manage software releases end-to-end: bump version, generate changelog, tag, push, GitHub release, publish to PyPI/npm. Use when asked to ship, cut a release, or tag a version. Don't use for routine commits or marketplace publishing.
doris-repo-review
Review an Apache Doris PR from a local clone with the same multi-agent, shared-ledger convergence workflow as the CI Code Review Runner. Use when the user supplies a PR to /doris-repo-review, asks to review a Doris PR locally, or asks for the CI-style review flow. Safely align only the current worktree to the exact PR…
doris-debug-import
Use for Doris Stream/Broker/Routine Load issues and Group Commit asyncmode WAL pile-up. Tunables: table groupcommitintervalms / groupcommitdatabytes; BE groupcommitinsertthreads, groupcommitwalpath, groupcommitwalmaxdisklimit.
gem-release
Automates the complete process of releasing a new version of the openclacky Ruby gem. Supports both stable releases (auto-increment) and pre-release versions (user-specified, e.g., 1.0.0.beta.1). Handles version bumping, testing, building, RubyGems publishing, GitHub Releases, and OSS CDN mirroring.