Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/gaelic-ghost/socket/release-readiness-workflownpx skills add gaelic-ghost/socket --skill release-readiness-workflowgit clone --depth 1 https://github.com/gaelic-ghost/socketWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00082 | $0.01047 |
| Opus 5 | $0.00041 | $0.00524 |
| Sonnet 5 | $0.00016 | $0.00209 |
| Haiku 4.5 | $0.00008 | $0.00105 |
Grade A, and why
release-readiness-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 108 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Android Release Readiness Workflow
Purpose
Check whether an Android app or library is ready for release without starting a publish workflow by default.
The practical decision is which version, signing, packaging, policy, changelog, and automation surfaces must be verified before a human or repo-owned release system publishes artifacts.
Source Check
Use repo-local Gradle files, release docs, CI workflows, Fastlane files, checked-out automation sources, and Dash.app docsets opportunistically for exact Gradle or Java questions. Use official documentation as authority for Android-specific release, signing, privacy, permissions, and Play behavior:
- Prepare and roll out a release
- Android App Bundles
- Sign your app
- Shrink, obfuscate, and optimize your app
- Play Developer API
- Fastlane supply documentation
Translate documentation into concrete release files, commands, artifacts, and gates.
Inspection Workflow
- Identify release ownership:
- app module
- release build type
- product flavors
- version code and version name
- changelog or release notes
- CI release workflow
- Fastlane, Gradle Play Publisher, Play Developer Publishing API client, or custom scripts
- Inspect signing boundaries:
- signing config names
- keystore references
- environment variable names
- secret-handling docs
- local placeholder configs
- Inspect packaging:
- app bundle tasks
- APK tasks
- R8/ProGuard files
- mapping output expectations
- native debug symbols if present
- Inspect policy-sensitive surfaces:
- permissions
- exported components
- privacy disclosures
- target SDK requirements
- Play delivery tracks and rollout docs
- Route automation:
- identify the repo-owned release command or CI job
- explain required credentials or approvals
- stop before publish unless the user explicitly requested the publish action
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 108 lines · 82 tokens per session scan A 42a2b8430e80
release-readiness-workflow is a skill published in the GitHub repository gaelic-ghost/socket (7 stars, last pushed 7d ago), licensed Apache-2.0. It adds 82 tokens to every session and 1,047 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
storescreens
Set up and run storescreens-cli to automate App Store screenshot capture for iOS apps: render captioned/framed App Store-ready screenshots with device bezels, markdown captions, and panoramic backgrounds; upload screenshots + per-locale metadata (name, subtitle, description, keywords, what's new, promotional text) to…
app-store-review
Evaluates code against Apple's App Store Review Guidelines. Use this skill when reviewing iOS, macOS, tvOS, watchOS, or visionOS app code (Swift, Objective-C, React Native, or Expo) to identify potential App Store rejection issues before submission. Triggers on tasks involving app review preparation, compliance…
swift-concurrency-pro
Reviews Swift code for concurrency correctness, modern API usage, and common async/await pitfalls. Use when reading, writing, or reviewing Swift concurrency code.
swiftui-pro
Comprehensively reviews SwiftUI code for best practices on modern APIs, maintainability, and performance. Use when reading, writing, or reviewing SwiftUI projects.
baocut
BaoCut-only operator for the installed bcut CLI and .bcut projects. Implicitly trigger only when the request explicitly names BaoCut or bcut, targets a .bcut project or BaoCut Subtitle Studio, or continues a BaoCut workflow already established in the conversation. Do not trigger solely for generic audio or video…
boutique-store
Create and use Boutique Store for Swift data persistence, including initialization, @Stored controllers, CRUD operations, operation chaining, and granular event monitoring. Use when persisting arrays of items, building data controllers, or working with Boutique's Store type.