Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ethanyoq/skill-hub/github-desktop-releasenpx skills add EthanYoQ/Skill-hub --skill github-desktop-releasegit clone --depth 1 https://github.com/EthanYoQ/Skill-hubWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.03008 |
| Opus 5 | $0.00024 | $0.01504 |
| Sonnet 5 | $0.00010 | $0.00602 |
| Haiku 4.5 | $0.00005 | $0.00301 |
Grade A, and why
github-desktop-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 145 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Desktop Release
Treat a desktop release as a state machine, not a build command. Keep application implementation, platform qualification, artifact identity, and public GitHub Release state as separate evidence boundaries.
electron-development owns Electron macOS build and qualification. This Skill may validate a macOS qualification artifact before promotion, but does not take over that platform's build work.
Pick the smallest justified cloud path
Classify the request before spending runner time. Do not turn a past infrastructure failure into a permanent requirement for every release.
- Compatibility preflight: a read-only or non-promotable check that proves each requested platform can receive the frozen source: runner label availability, locked-install viability, expected architecture/native binding load, and resolved asset plan. It produces no installer and cannot justify publication.
- Standard Windows qualification: the default for ordinary application-source releases when the Windows installer, upgrade path, Electron/Node ABI, signing policy, and installer configuration are unchanged. It builds one installer and proves core installability.
- Deep Windows acceptance: adds upgrade-data, native-ABI, and project-specific migration/installer checks. Use it only when its trigger is present or the user explicitly requests it.
- Promotion/readback: consumes already-qualified bytes. It never builds, installs, or substitutes an artifact.
For a multi-platform release, choose between a staged canary and a parallel formal matrix from the release-risk delta. Ask electron-development to own macOS preflight and qualification work. A staged canary protects expensive minutes when release infrastructure changed; a parallel matrix protects elapsed time when that infrastructure is already proven.
Establish scope
- Read the repository's
AGENTS.md, domain docs, packaging configuration, workflows, release scripts, and tests. Use CodeGraph first when the project is indexed. - Record the repository, default branch, full source SHA, tag, version, requested platforms/architectures, signing policy, expected assets, and authorization boundary.
- Keep project facts in a repository release profile, not in this Skill. Read references/release-profile.md, then validate the selected profile:
What ships with it
28 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 339 B
- assets/electron-nsis-qualification.yml 40 KB
- assets/github-desktop-release-promotion.yml 5.6 KB
- assets/macos-qualification.yml 18 KB
- assets/release-profile.schema.json 4.8 KB
- evals/evals.json 9.3 KB
- references/agent-orchestration.md 1.4 KB
- references/cloud-execution-strategy.md 6.3 KB
- references/electron-nsis.md 7.5 KB
- references/evidence-contract.md 7.8 KB
- references/failure-classification.md 2.3 KB
- references/failure-playbook.md 4.5 KB
- references/github-release-state-machine.md 5.8 KB
- references/macos-qualification.md 2.2 KB
- references/promotion-preflight.md 2.7 KB
- references/receipt-replay.md 2.7 KB
- references/release-contract.md 4.1 KB
- references/release-profile.md 4.9 KB
- references/stack-adapters.md 4.4 KB
- scripts/classify-actions-failure.mjs 2.6 KB runs code
- scripts/github-desktop-promotion.mjs 39 KB runs code
- scripts/preflight-windows-release.ps1 15 KB runs code
- scripts/replay-release-evidence.mjs 5.7 KB runs code
- scripts/test-github-desktop-promotion.mjs 19 KB runs code
- scripts/test-preflight.ps1 12 KB runs code
- scripts/test-release-tools.mjs 9.3 KB runs code
- scripts/test-workflow-assets.ps1 30 KB runs code
- scripts/validate-release-profile.mjs 11 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 145 lines · 48 tokens per session scan A cf312167b6a4
github-desktop-release is a skill published in the GitHub repository EthanYoQ/Skill-hub (9 stars, last pushed 4d ago), licensed MIT. It adds 48 tokens to every session and 3,008 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
land-and-deploy
Land and deploy workflow. (gstack).
release
Release workflow for deploying OpenEnv environments to Hugging Face Spaces and keeping canonical references in sync.
release-beta
Publish the next AlphaClaw beta and always update the Railway beta template pin to the exact released beta version.
dashclaw-ship
The single command that gets a DashClaw change ON MAIN AND LIVE — it resolves everything blocking production, never defers, and never hands back a checklist. Lands feature branches on main (rebase, gate, merge, push so Vercel deploys), bumps the unified platform+SDK version, and realigns every description of the…
deploy-hf
Release a new imcui version and deploy to HuggingFace Spaces (test → prod). Invoke when user asks to release, deploy, or ship a new version.
flux-controller-patch-releases
Run the upstream Flux controller patch release procedure for helm-controller, image-automation-controller, image-reflector-controller, kustomize-controller, notification-controller, source-controller, and source-watcher. Use when preparing a new controller patch release from a release series branch, drafting changelog…