Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add EmpiricaAI/empirica --skill pre-publishgit clone --depth 1 https://github.com/EmpiricaAI/empiricaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/empiricaai/empirica/pre-publish)<a href="https://agentmods.dev/skills/empiricaai/empirica/pre-publish"><img src="https://agentmods.dev/badge/skills/empiricaai/empirica/pre-publish/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/empiricaai/empirica/pre-publish"><img src="https://agentmods.dev/badge/skills/empiricaai/empirica/pre-publish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00101 | $0.01231 |
| Opus 5.5 | $0.00040 | $0.00492 |
| Sonnet 5.5 | $0.00020 | $0.00246 |
| Haiku 4.5 | $0.00010 | $0.00123 |
Grade A, and why
pre-publish scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pre-publish
Load this before you push a release or publish, not after something ships wrong.
Deterministic gates catch what someone thought to check. An independent sweep catches what nobody did. On 1.14.13, CI was green on the exact commit and the compliance report passed 15 of 16 checks; three read-only reviewers then flagged 23 candidates and 9 held up under tracing, including a new destructive command whose reference check was missing a whole store. No test could have failed on that, because the defect was an absence.
The sequence (the order matters)
- Scope.
git diff <last-tag>..HEAD --stat. Group the changed files into 3 to 5 areas. Note whether any hook, or the PREFLIGHT/CHECK/POSTFLIGHT path, changed: that decides step 5. - Deterministic tier: a tool's job, not yours. Lint, types, full tests, dependency CVE audit, secret scan, docs drift. Fix
failures; do not waive them. A CVE with a published fix is a floor bump, not a note. In empirica this is
empirica compliance-report --dep-audit --securityplusrelease.py --prepare(references/empirica-release.md). - Independent sweep. One read-only reviewer per area, in parallel, each with the brief in
references/sweep-brief.md. They do not edit, apply, or run anything that mutates. The pattern table they apply is eat-the-broccoli, Phase 2. - Trace every finding yourself. A reviewer's verdict is an uncalibrated self-report. For each finding: open the file:line, reproduce or trace it end to end, ask whether it is by design, then either fix it failing-test-first or log it as a goal or unknown. Keep three numbers and report them: candidates, confirmed, fixed. Say plainly which confirmed ones are still open.
- Hot path. If hooks or PREFLIGHT/CHECK/POSTFLIGHT changed, time the real path on the last tag's copy against the new one, same inputs, 15 runs each. A per-call cost regression blocks the cut; a removal that was already short-circuited is neutral, not a saving.
- Gaps. Code against docs: new verbs and flags documented, removed names still referenced anywhere (docs, prompts, skills, scripts), the changelog's top entry is this release.
- Re-run on the exact commit you will release. Green CI on a neighbouring commit is not green on this one.
- Cut and verify (
references/empirica-release.md). Wait for the release run by its id; verify the artifacts, not the job status.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 62 lines · 101 tokens per session scan A 476488ec44aa
pre-publish is a skill published in the GitHub repository EmpiricaAI/empirica (253 stars, last pushed today), licensed MIT. It adds 101 tokens to every session and 1,231 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-26.
Other skills, from other repositories
version-bump
Automated semantic versioning and release workflow for Claude Code plugins. Handles version increments across package.json, marketplace.json, plugin.json manifests, build verification, git tagging, GitHub releases, and changelog generation. npm publishing is done by the tag-triggered GitHub Actions workflow through…
antigravity-maintainer-batch-release
Run protected AAS maintainer sweeps, PR merge batches, resumable review, immutable distribution, Core checks, and scripted releases. Use for repository maintenance, main alignment, CLI/MCP/Workbench changes, or release work; not ordinary contribution tasks.
app-store-changelog
Generate user-facing App Store release notes from git history since the last tag.
childhood
Babysit a shipped release after merge, publication, or deployment. Verify published packages, production behavior, installed plugins, and late CI or user reports until the observation window is clean; use babysit for PR readiness before release.
build-and-release
Fully automate building and releasing a coding task.
release
Fully automate a release with version-bump and childhood.