Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gtapps/hermitd --skill pre-release-reviewgit clone --depth 1 https://github.com/gtapps/hermitdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gtapps/hermitd/pre-release-review)<a href="https://agentmods.dev/skills/gtapps/hermitd/pre-release-review"><img src="https://agentmods.dev/badge/skills/gtapps/hermitd/pre-release-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gtapps/hermitd/pre-release-review"><img src="https://agentmods.dev/badge/skills/gtapps/hermitd/pre-release-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00188 | $0.03155 |
| Opus 5.5 | $0.00075 | $0.01262 |
| Sonnet 5.5 | $0.00038 | $0.00631 |
| Haiku 4.5 | $0.00019 | $0.00315 |
Grade A, and why
pre-release-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- pre-release-review — 95% identical, 6 lines differ
How it starts
The opening of the file, as written. The whole thing — 220 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pre-Release Review
Run this gate immediately before $release or $fleet-release. Answer:
- What is actually shipping in each plugin?
- Does each plugin's
[Unreleased]changelog accurately describe that diff? - Per the mode picked in Step 0: does a dedicated Codex review find correctness problems in the union release window (Step 4), or is what shipped the right design for a downstream hermit (Step 3D)?
Keep Steps 1–3 and 3D read-only. Do not edit changelogs, bump versions, commit, tag, or push. Step 4 may edit only when the user chose the disclosed review-and-fix mode in Step 0.
Invocation
$pre-release-review— audit every plugin with commits since its own last tag.$pre-release-reviewfor one or more<plugin-slug>s — audit only those plugins.- Any trailing free text is the objective: it settles the Step 0 mode when it clearly names one ("design review", "run the deep pass too") and otherwise becomes the lens the verdict answers.
When installed, $release-status is an optional lightweight precursor. $docs-drift is the documentation follow-up after this changelog-vs-code audit.
Step 0 — Pick the mode
Ask once, in one message, before any git work, unless the invocation already settles it. Offer three options and accept a free-text objective alongside any of them:
- Readiness audit (default) — Steps 1–3. Cheap, read-only.
- Audit + deep correctness review — Steps 1–4. Choosing this authorizes the Step 4 native code review (read-only) and the disclosed confirmed-fix pass; state the cost and that confirmed fixes edit the working tree, and do not ask again later.
- Design review — Steps 1–3, then Step 3D: an adversarial critique of what shipped (overengineering, alternative designs, downstream-hermit impact), sourced from the PRs, issues, and proposals behind the window. Read-only.
A free-text objective does two things: the Verdict answers it ("ready to tag for ", never an unqualified ready), and Step 3 flags anything in the window that does not serve it as scope creep, even when it is correctly documented.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 220 lines · 188 tokens per session scan A f87c71a63e10
pre-release-review is a skill published in the GitHub repository gtapps/hermitd (79 stars, last pushed today), licensed MIT. It adds 188 tokens to every session and 3,155 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-02.
Other skills, from other repositories
open-pr
Use this skill to submit the commits on the current branch as one pull request against a GitHub repository. Push the branch, open the PR with an imperative title and a body that names what changed and why, and post a follow-up ping only when CODEOWNERS resolves to one person. One branch per run, one pull request per…
merging-to-main
Keyword-gated by name. Merge a ready branch to main via PR.
finishing-a-development-branch
Presents merge, PR, or cleanup options once tests pass.
github
GitHub via gh CLI: PRs, issues, reviews, repos, auth.
release
Cut a brooks-lint release: set the version in package.json, propagate it across all four plugin manifests and every version-bearing text file (README badges, docs site metadata), write the CHANGELOG entry, validate, then commit, push, tag, and publish the GitHub release. Triggers when the maintainer asks to "release"…
pre-publish-review
Nuclear-grade 12-agent pre-publish release gate. Runs /get-unpublished-changes to detect all changes since last npm release, spawns up to 10 ultrabrain agents for deep per-change analysis, invokes /review-work (orchestrator manual QA plus one gate reviewer) for holistic review, and 1 oracle for overall release…