Borrowing it
Nothing to install: this file belongs to f-is-h/Usage4Claude. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/f-is-h/Usage4Claude/main/.agents/skills/release/SKILL.mdgit clone --depth 1 https://github.com/f-is-h/Usage4ClaudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/f-is-h/usage4claude/release)<a href="https://agentmods.dev/skills/f-is-h/usage4claude/release"><img src="https://agentmods.dev/badge/skills/f-is-h/usage4claude/release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/f-is-h/usage4claude/release"><img src="https://agentmods.dev/badge/skills/f-is-h/usage4claude/release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 120 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 121 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 120 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 121 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.03326 |
| Opus 5.5 | $0.00031 | $0.01330 |
| Sonnet 5.5 | $0.00015 | $0.00665 |
| Haiku 4.5 | $0.00008 | $0.00333 |
Grade A, and why
release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 215 lines — stays where its author put it; the contents beside it link to each section on GitHub.
发布新版本（Release）
Usage4Claude 采用 CI 自动发布：向 main push 一个满足条件的 commit 后，
GitHub Actions（.github/workflows/release.yml）自动完成构建、签名、发 Release、
更新 Sparkle 更新源。你（Claude）的职责是准备好发版材料并引导用户完成触发，
不代替用户执行发版 commit 与 push。
若根目录存在
NEXT_RELEASE.md，说明本次发版有一次性特殊情况，先读它再按本流程走。
必须先记住的架构事实
- 两份发布材料，各司其职（详见下一节分工表）：
CHANGELOG.md— 完整技术档案 + 版本号权威源，不进 Sparkle。docs/RELEASE_NOTES.md— 面向用户的发布说明，CI 提取当前版本段落后同时注入 Sparkle 弹窗（appcast.xml的<description>）和 GitHub Release 正文。
- 触发条件：commit message 含
[release]/[RELEASE]，push 到main，且本次改动 包含CHANGELOG.md或docs/RELEASE_NOTES.md（发版通常两者都改）。 - Sparkle 弹窗内容来自 docs/RELEASE_NOTES.md（不是 CHANGELOG）。用户在应用内“检查更新” 看到的就是 RELEASE_NOTES 当前版本段落。
- docs/RELEASE_NOTES.md 必须有当前版本段落：否则 Sparkle/Release 正文会为空。CI 的
validate 阶段会
grep "^## [X.Y.Z]"fail-fast，但应发版前就写好。 - Build 号自动跟随：
CURRENT_PROJECT_VERSION = $(MARKETING_VERSION)，Build 恒等于 Version。只改 Version，绝不手动固定 Build，否则 Sparkle 认不出新版本。 - appcast.xml 由 CI 维护，绝不手改。
- 详细背景见
docs/DAILY_RELEASE_WORKFLOW.md、docs/SPARKLE_SETUP.md。
两份材料的分工（关键）
| CHANGELOG.md | docs/RELEASE_NOTES.md | |
|---|---|---|
| 定位 | 完整技术档案 + 版本号权威源 | 面向用户的发布说明 |
| 收录范围 | 所有改动，含内部重构、CI、安全加固 | 只留用户可感知的现象 |
| 措辞 | 可保留技术细节（JWT、actor、base64url 等） | 口语化，去技术词 |
| 致谢 | 不加 | 在相关条目末尾加 (thanks @author, #N) |
| CI 喂给 | 无（纯档案；validate 从它提版本号） | Sparkle 弹窗 + GitHub Release 正文 |
| 何时写 | 发版前 | 发版前（不是发布后精修） |
规则细节见
docs/CHANGELOG_AND_RELEASE_NOTES_GUIDELINES.md。
流程
1. 收集自上个 tag 以来的变更
git fetch origin # 先核对远程，避免发版已在别处完成
LAST_TAG=$(git describe --tags --abbrev=0) # 上一个发布 tag，如 v3.3.0
git log "$LAST_TAG"..HEAD --oneline # 变更概览
git log "$LAST_TAG"..HEAD --format='=== %h ===%n%B' # 完整 message（判断影响面必读）
git log "$LAST_TAG"..HEAD --merges --format='%h %s' # 合并的 PR（用于致谢）
逐条阅读完整 message，区分：用户可感知的现象 vs 纯内部改动。两类都进 CHANGELOG， 但只有前者进 RELEASE_NOTES。
2. 决定版本号
读 CHANGELOG.md 顶部当前版本，按语义化递增：
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 215 lines · 77 tokens per session scan A 5f35ed794a3d
release is a skill published in the GitHub repository f-is-h/Usage4Claude (411 stars, last pushed 29d ago), licensed MIT. It adds 77 tokens to every session and 3,326 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
release
Cut and publish a new GitHub release for the ClaudeCodeNotify macOS app. Use this whenever the user wants to release, ship, publish, cut, or tag a new version — phrases like "create a release", "ship the release", "publish v1.0.x", "tag and release the app", "cut a new version", or "make a release". It builds the…
release
Prepare, verify, and publish Sutando engine releases. Use when asked to prepare a release proposal, determine a version bump, audit release documentation, validate release gates, create a release PR, tag a confirmed release, or publish GitHub release notes. Preparation is safe and non-publishing; tagging and…
utility-pm-release-conductor
Walk the guided 6-gate release runbook (G0 readiness, G1 adversarial review, G2 version bump and CHANGELOG, G2.5 commit and re-verify, G3 tag and push, G4 post-tag hygiene) via the pm-release-conductor sub-agent. Refuses gate bypasses and tags only the re-verified SHA. Use when cutting a pm-skills release.
utility-pm-changelog-curator
Draft CHANGELOG entries from git log via the pm-changelog-curator sub-agent, applying the repo hygiene rules (describe what changed, public paths only, no attribution trailers). Returns a layered draft with a status summary for maintainer review; refuses a dirty working tree unless --committed-only is passed. Use when…
deliver-release-notes
Creates user-facing release notes that communicate new features, improvements, and fixes in clear, benefit-focused language. Use when shipping updates to communicate changes to users, customers, or stakeholders.
starcat-update-changelog
Update Starcat changelog documents in supports/starcat-pro/ by reading ALL git commits from the main Starcat project and generating categorized release notes in both English and Chinese. Use this skill whenever the user wants to update changelog, release notes, update records, or sync the changelog with recent…