Borrowing it
Nothing to install: this file belongs to fanfan-de/anybox. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/fanfan-de/anybox/master/.agents/skills/anybox-mobile-release/SKILL.mdgit clone --depth 1 https://github.com/fanfan-de/anyboxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fanfan-de/anybox/anybox-mobile-release)<a href="https://agentmods.dev/skills/fanfan-de/anybox/anybox-mobile-release"><img src="https://agentmods.dev/badge/skills/fanfan-de/anybox/anybox-mobile-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fanfan-de/anybox/anybox-mobile-release"><img src="https://agentmods.dev/badge/skills/fanfan-de/anybox/anybox-mobile-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00093 | $0.02258 |
| Opus 5 | $0.00046 | $0.01129 |
| Sonnet 5 | $0.00019 | $0.00452 |
| Haiku 4.5 | $0.00009 | $0.00226 |
Grade A, and why
anybox-mobile-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 227 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Anybox 移动端开发与发布
核心规则
- 从仓库根目录执行命令。
- 将
packages/mobile-app/app.json作为 production 的版本、AndroidversionCode、仓库、标签前缀、更新端点和发布资产名称的唯一事实来源。 - 保持
app.json只描述 production。日常 Android 开发通过受校验的 development profile 派生com.anybox.mobile.dev、Anybox Mobile Dev和anybox-mobile-dev。 - 严格区分本地验证与外部发布。不得为了证明流程可行而修改 preview 或 production。
- 发布 OTA 或 APK 前，要求源码已提交且任务范围内工作区干净。
- 发布原生 production 版本前，要求提供真实设备证据。
- 不得虚构截图、Smoke 结果或设备覆盖。
- 安装、清数据、替换或卸载应用前，必须确认 ADB 序列号、目标包、签名兼容性 和数据丢失行为。
移动端 GitHub Release 必须使用以下独立身份：
- 标签以
mobile-v开头，例如mobile-v0.3.1。 - 资产包括
anybox-mobile.apk、anybox-mobile-release.json和anybox-mobile-release.json.sig。 - 不得使用
releases/latest发现移动端版本。 - 不得把移动端版本标记为 GitHub latest；使用
--latest=false或make_latest: "false"。 - 移动端只筛选
mobile-v*Release。
必须遵守的生命周期
依次通过四道门禁：
- 使用 Metro 或原生开发包完成本地开发。
- 使用独立 APK 完成真实设备 Smoke。
- 验证不可变 preview OTA 或正式签名原生候选包。
- 完成 production 发布，并通过正常用户路径复验。
处理开发、测试、设备策略、发布分类、人工清单或无发布验证时，读取
references/development-test-release.md。
处理 GitHub 资产名称、Manifest 结构、命令格式、恢复、Windows 工具链或上传
故障时，读取 references/github-mobile-release.md。
门禁 1：低成本检查
在耗时的 Android 构建前执行：
corepack pnpm mobile:doctor --strict
corepack pnpm mobile:typecheck
corepack pnpm --filter anybox-mobile-app exec expo install --check
运行与改动区域匹配的测试。涉及更新和发布工具时执行：
corepack pnpm --filter anybox-mobile-app test:update-tools
仅修改页面、React 组件、样式、文案、翻译或普通 JavaScript/TypeScript 逻辑时， 优先使用 development 原生客户端连接 Metro：
corepack pnpm mobile:android:dev -- --device <adb-serial>
保持 Metro 终端运行，保存源码后使用 Fast Refresh；未自动刷新时在 Metro 终端按
r。纯 UI 且不依赖 Anybox 自定义原生模块时，也可通过
mobile:start -- --lan --port 8082 使用 Expo Go。具体选择、连接、反馈时间和
退出 Metro 后的验收要求见 references/development-test-release.md。
需要与正式版并存、内嵌最新 JavaScript 的日常真机包时执行：
corepack pnpm mobile:android:deploy:dev -- --serial <adb-serial>
该命令必须执行 typecheck、按目标 ABI 构建内嵌 JS 的 APK、校验
com.anybox.mobile.dev、只调用 adb install -r，并启动开发版。不得卸载或
清除应用数据；签名冲突时只能报告失败。开发版本地沙箱与正式版隔离，但仍可能
访问 production Provider/Relay；优先使用测试账号。
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 227 lines · 93 tokens per session scan A 52f94eacff2e
anybox-mobile-release is a skill published in the GitHub repository fanfan-de/anybox (57 stars, last pushed 28d ago), licensed MIT. It adds 93 tokens to every session and 2,258 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
axiom-shipping
Use when preparing ANY app for submission, handling App Store rejections, writing appeals, or managing App Store Connect. Covers submission checklists, rejection troubleshooting, metadata requirements, privacy manifests, age ratings, export compliance.
asc-ad-hoc-distribution
Prepare, publish, resume, and verify private iOS release-testing installs with asc distribute. Use when distributing an IPA to registered devices outside TestFlight, reconciling ad hoc profiles, publishing through caller-owned S3-compatible storage, or diagnosing a resumable private distribution run.
release-new-version
Use when the user wants to release a new Zafiro version — drafting bilingual release notes, deciding the next version number, bumping app/build.gradle.kts, tagging, and publishing to GitHub (main repo, optionally the Xposed repo).
suede-play-release
Suede Labs Google Play delivery skill: ship an Android release end to end from the agent interface, without opening the Play Console. Set up credentials, upload an AAB, promote between tracks, stage or complete a rollout, push per-locale release notes, and prove against the Play Developer API what is actually live.…
testflight-release
Ship a new TestFlight build of the iOS companion (TermioMobile) — resolve the next build number against App Store Connect, archive, sign, export, upload, write the What to Test notes, and distribute. Invoke when the user says 'ship a testflight build', 'update testflight', 'upload to testflight', 'new beta build'…
app-release
End-to-end pipeline for releasing an iOS / watchOS app to TestFlight and the App Store. Use when the user wants to publish, ship, or release an iOS/watchOS app, get a build onto TestFlight, archive and upload via xcodebuild, deploy a CloudKit schema to Production, set App Privacy or export compliance, mint a…