Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add giginet/apple-icon-composer-skill --skill releasegit clone --depth 1 https://github.com/giginet/apple-icon-composer-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/giginet/apple-icon-composer-skill/release)<a href="https://agentmods.dev/skills/giginet/apple-icon-composer-skill/release"><img src="https://agentmods.dev/badge/skills/giginet/apple-icon-composer-skill/release.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.01170 |
| Opus 5 | $0.00044 | $0.00585 |
| Sonnet 5 | $0.00017 | $0.00234 |
| Haiku 4.5 | $0.00009 | $0.00117 |
Grade A, and why
release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Release a new version
This repo ships a Claude Code / Codex plugin. A release is: bump the version in
every manifest, relock, verify, commit to main, then create a GitHub release
whose tag gh creates for you.
There is no CHANGELOG file — release notes are generated from merged PR titles, so nothing needs to be hand-written.
1. Decide the version
Ask the user if they did not say. Otherwise infer from what landed since the last tag:
git fetch origin --tags
git log --oneline $(git describe --tags --abbrev=0)..origin/main
Tags are vX.Y.Z (lightweight, created by gh release create). Normalize a
shorthand like "1.2" to the full 1.2.0 — every existing tag is three-part.
2. Preflight
git switch main && git pull --ff-only
git status --short # must be empty
Do not start from a dirty tree or a stale main. If the release is for a PR the
user just merged, confirm the merge commit is present in git log.
3. Bump the version
Find every file carrying the current version — do not trust a hardcoded list, manifests get added:
grep -rn "<current-version>" --include="*.json" --include="*.toml" --include="*.lock" .
As of 1.2.0 that is four files:
| File | How to update |
|---|---|
plugins/icon-composer/.claude-plugin/plugin.json |
edit "version" |
plugins/icon-composer/.codex-plugin/plugin.json |
edit "version" |
plugins/icon-composer/skills/compose-app-icon/scripts/pyproject.toml |
edit version = |
plugins/icon-composer/skills/compose-app-icon/scripts/uv.lock |
never hand-edit — see below |
.claude-plugin/marketplace.json (repo root) carries no version. Leave it alone.
Regenerate the lock instead of editing it:
cd plugins/icon-composer/skills/compose-app-icon/scripts && uv lock
Then inspect the diff. pyproject.toml sets exclude-newer = "1 week", which is
relative to now, so uv lock always rewrites the exclude-newer timestamp:
git diff plugins/icon-composer/skills/compose-app-icon/scripts/uv.lock
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 132 lines · 87 tokens per session scan A 2a6bd45ce736
release is a skill published in the GitHub repository giginet/apple-icon-composer-skill (33 stars, last pushed 13d ago), licensed Apache-2.0. It adds 87 tokens to every session and 1,170 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
asc-ad-hoc-distribution
Prepare, publish, resume, and verify private iOS release-testing installs with asc distribute. Use when distributing an IPA to registered devices outside TestFlight, reconciling ad hoc profiles, publishing through caller-owned S3-compatible storage, or diagnosing a resumable private distribution run.
apple-app-delivery
Upload builds, distribute on TestFlight, manage metadata, submit for Beta/App Review, and release on the App Store using Apple's official CLIs and the App Store Connect API. Default stable delivery to APPSTORE so one build can be tested in TestFlight and later submitted to the App Store; choose TESTFLIGHTINTERNALONLY…
apple-release-ops
The mechanics of shipping Apple apps. Use for ANY code signing error ("no signing certificate", "provisioning profile doesn't include...", "revoked certificate"), provisioning profiles, certificates, entitlements, capabilities, TestFlight (groups, expiry, feedback), App Store Connect, uploading builds, xcodebuild…
app-store-changelog
Create user-facing App Store release notes by collecting and summarizing all user-impacting changes since the last git tag (or a specified ref). Use when asked to generate a comprehensive release changelog, App Store "What's New" text, or release notes based on git history or tags.
release-announcement
Write a release announcement — changelog, blog post, in-app note, or social post — that leads with user impact, names the audience, and includes upgrade/migration steps without filler.
agent-release-swarm
Agent skill for release-swarm - invoke with $agent-release-swarm.