A final review gate for handing a Draft track to a human through a git upload, push, or pull request. It checks review results, required approvals, deployment readiness, and validator results before submission.

Use it before pushing a completed track or opening a pull request. It verifies that the track has passed review and that the required release checks are clear.

It prevents incomplete or blocked work from being uploaded for review. It also catches missing reviews, approvals, deployment checks, or code-quality and citation problems.

upload — Skill for Claude Code by drafthq/draft

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add drafthq/draft --skill upload

Clone the repo

git clone --depth 1 https://github.com/drafthq/draft

Made for: Claude Code.

Or install draft, the plugin that ships this one along with the rest of its 33 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/drafthq/draft/upload/github.svg)](https://agentmods.dev/skills/drafthq/draft/upload)

Your own site

<a href="https://agentmods.dev/skills/drafthq/draft/upload"><img src="https://agentmods.dev/badge/skills/drafthq/draft/upload/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/drafthq/draft/upload"><img src="https://agentmods.dev/badge/skills/drafthq/draft/upload.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 32 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,084 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector pass 7 Sept 2026

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00032	$0.01084
Opus 5.5	$0.00013	$0.00434
Sonnet 5.5	$0.00006	$0.00217
Haiku 4.5	$0.00003	$0.00108

Measured 1mo ago against content hash f4e9479623ae, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

upload scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/upload/SKILL.md · 120 lines

How it starts

The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Upload for Review

Gate track completion before git upload, git push, or opening a PR for human review.

Red Flags — STOP if you're

See shared red flags.

Skill-specific:

Uploading without a passing /draft:review on the track
Skipping HLD §Approvals for criticality ∈ {high, mission-critical} tracks
Treating a deploy checklist with status: BLOCKED as passing
Pushing when validator tools report hygiene or citation drift

Upload is a gate, not a shortcut around review.

Step 1: Resolve Track

Parse track <id|name> from arguments, or auto-detect the active [~] track from draft/tracks.md.
Load draft/tracks/<id>/spec.md, plan.md, metadata.json, and hld.md when present.
If no track resolves, error: "No track to upload. Specify track <id> or activate a track."

Step 2: Pre-Upload Verification

2.1 Review gate

Require review-report-latest.md on the track with verdict PASS or PASS WITH NOTES.
If missing or FAIL, stop and instruct: run /draft:review track <id> first.

2.2 Deploy checklist (auto-invoke)

Run /draft:deploy-checklist track <id> when no fresh passing checklist exists.

2.5 Checklist status

Read draft/tracks/<id>/deploy-checklist-latest.md (or timestamped sibling).
If frontmatter contains status: BLOCKED, stop — checklist is not a passing gate.
Critical unchecked items block upload.

2.3 Validator chain

Run the WS-9 chain from verification-gates.md against the track directory. Any non-zero exit aborts upload.

TRACK_DIR="draft/tracks/<id>"
DRAFT_TOOLS="${DRAFT_PLUGIN_ROOT:-$(cat ~/.cache/draft/plugin-root 2>/dev/null)}/scripts/tools"
[ -d "$DRAFT_TOOLS" ] || DRAFT_TOOLS="$(ls -d ~/.claude/plugins/cache/*/draft/*/scripts/tools 2>/dev/null | sort -V | tail -1)"
[ -d "$DRAFT_TOOLS" ] || DRAFT_TOOLS="$(ls -d ~/.claude/plugins/marketplaces/*draft*/scripts/tools 2>/dev/null | tail -1)"
[ -d "$DRAFT_TOOLS" ] || DRAFT_TOOLS="$PWD/scripts/tools"

"$DRAFT_TOOLS/check-track-hygiene.sh" "$TRACK_DIR"
"$DRAFT_TOOLS/verify-citations.sh" "$TRACK_DIR"
"$DRAFT_TOOLS/verify-doc-anchors.sh" "$TRACK_DIR"
"$DRAFT_TOOLS/diff-templates-vs-tracks.sh" "$TRACK_DIR"

Read the full file on GitHub · 120 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 120 lines · 32 tokens per session scan A f4e9479623ae

Subscribe to this mod's changes

upload is a skill published in the GitHub repository drafthq/draft (40 stars, last pushed 11d ago), licensed MIT. It adds 32 tokens to every session and 1,084 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Claude Code Code review Git and workflow Planning Releases ai-code-review ai-coding copilot cursor

gentle-ai-collab-perfect

Trigger: contributing to Gentleman-Programming/gentle-ai as an external collaborator. Strict issue-first workflow, honest PR bodies, contributor-vs-maintainer scope, chained-PR strategy, verification protocol, docstring coverage. Load whenever the active repo is Gentleman-Programming/gentle-ai and any part of the…

Gentleman-Programming/gentle-ai · 106 tokens

upload