Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/eduardo-sl/go-agent-skillsnpx agentmods add skills/eduardo-sl/go-agent-skills/go-build-releaseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/eduardo-sl/go-agent-skills/go-build-release)<a href="https://agentmods.dev/skills/eduardo-sl/go-agent-skills/go-build-release"><img src="https://agentmods.dev/badge/skills/eduardo-sl/go-agent-skills/go-build-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/eduardo-sl/go-agent-skills/go-build-release"><img src="https://agentmods.dev/badge/skills/eduardo-sl/go-agent-skills/go-build-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00152 | $0.01851 |
| Opus 5.5 | $0.00061 | $0.00740 |
| Sonnet 5.5 | $0.00030 | $0.00370 |
| Haiku 4.5 | $0.00015 | $0.00185 |
Grade A, and why
go-build-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 162 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Go Build and Release
A release is a promise that the binary users run is the one your source and pipeline produced. Make it reproducible so anyone can rebuild it, and verifiable so anyone can check it — before automating the publishing.
Detailed reference material, loaded on demand:
references/goreleaser.md— a complete.goreleaser.yamland the tag-triggered release workflow.references/supply-chain.md— SBOMs, cosign signing and verification, provenance attestations, signing container images.
Read a reference file only when the summary below is not enough.
1. Version Stamping
// Go 1.24+: built from a git checkout, Main.Version is the tag (v1.4.0)
// or a pseudo-version; vcs.* settings carry the commit and dirty flag.
info, _ := debug.ReadBuildInfo()
fmt.Println(info.Main.Version, info.GoVersion)
go version -m ./bin/api # inspect what a binary was built from
- Prefer build info: it needs no flags and cannot drift from the source.
- When a release tool builds from an archive without
.git, inject the values:-ldflags "-X main.version=v1.4.0 -X main.commit=$SHA". - Never stamp the wall-clock build time — it makes every build unique. Use the commit time if you need a date.
2. Reproducible Builds
The same source, toolchain and flags must give byte-identical binaries:
CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o bin/api ./cmd/api
sha256sum bin/api # rebuild in a clean checkout and compare
-trimpathremoves your machine's paths from the binary.- Pin the toolchain: the
goandtoolchainlines ingo.mod, the same image orsetup-goversion in CI. Go's own toolchain is reproducible since 1.21. CGO_ENABLED=0unless you need cgo — a C toolchain is one more input that varies between machines.go mod downloadandgo mod verifybefore building, so a tampered module cache fails the build.
3. Cross-Compilation
go tool dist list # every GOOS/GOARCH pair
GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -trimpath -o bin/api-linux-arm64 ./cmd/api
GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -trimpath -o bin/api.exe ./cmd/api
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 162 lines · 152 tokens per session scan A 935534eafb25
go-build-release is a skill published in the GitHub repository eduardo-sl/go-agent-skills (80 stars, last pushed 7d ago), licensed MIT. It adds 152 tokens to every session and 1,851 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-16.
Other skills, from other repositories
audit-release-go-version
Audit the effective Go builder versions used by images in an OpenShift Container Platform release image or payload against a requested Go version. Use when the user asks which OCP release images were built with a different Go version, wants a concise payload Go-version audit, or needs Dockerfile builder evidence for…
go-install-skill
A Go installation helper for installing Go, a programming language and its development tools. It supports package managers, official binaries, or Docker, and checks whether Go is already installed.
go-containers
Go container optimization — scratch/distroless images, static binaries, CGO, ldflags, trimpath (846MB to 2.5MB). Use when working with Go containers or optimizing Go image sizes.
go-deploy
Build and deploy Go applications — version detection, static binaries, CGO, workspaces, and Dockerfile patterns. Use when deploying a Go project, or when go.mod is detected.
kubernetes-operator-development
Designs, implements, reviews, tests, and operates Kubernetes operators and controllers in Go with Kubebuilder and controller-runtime. Use when defining CRDs, reconciliation loops, status conditions, finalizers, admission webhooks, external-provider controllers, operator upgrades, envtest suites, or controller-runtime…
golang-k8s-agent
Use when building Go-based Kubernetes agents/controllers, reconcile loops, or cloud-native systems. Invoke for controller-runtime, CRDs, leader election, and Go concurrency.