Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gustavo-meilus/aiboarding --skill cutting-a-releasegit clone --depth 1 https://github.com/gustavo-meilus/aiboardingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gustavo-meilus/aiboarding/cutting-a-release)<a href="https://agentmods.dev/skills/gustavo-meilus/aiboarding/cutting-a-release"><img src="https://agentmods.dev/badge/skills/gustavo-meilus/aiboarding/cutting-a-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gustavo-meilus/aiboarding/cutting-a-release"><img src="https://agentmods.dev/badge/skills/gustavo-meilus/aiboarding/cutting-a-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.00909 |
| Opus 5 | $0.00042 | $0.00454 |
| Sonnet 5 | $0.00017 | $0.00182 |
| Haiku 4.5 | $0.00008 | $0.00091 |
Grade A, and why
cutting-a-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 38 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cutting an aiboarding Release
Cut a version release after the feature work is merged into main. Full step detail + gotchas live in RUNBOOK.md - read it before acting.
Hard constraints (read first)
mainrequires a pull request and its required checks. Do not push release changes directly.- Exact-SHA CI evidence is required. Before tagging, run
bash tools/verify-release-sha <target-sha>; local checks do not replace it. - One version target. Only
.Codex-plugin/plugin.json(version) carries the version.marketplace.jsonhas NO per-plugin version field - do not add one. There is no package.json /.version-bump.json/.cursor-plugin/ AGENTS.md version. - JSON must be BOM-free. Never
Set-Content -Encoding UTF8for JSON. Use the Edit tool orpython3writes (encoding="utf-8"). - Tag ↔ changelog convention (stated in
CHANGELOG.mdheader): every tagvX.Y.ZMUST have a matching## X.Y.ZCHANGELOG entry and a## vX.Y.ZRELEASE-NOTES entry beforegh release create. - gh CLI in Bash tool: never
--body @'...'@(PowerShell here-string, fails). Write the body to a temp.md, use--body-file, thenrmit. Keep temp files out of commits. - Title form:
vX.Y.Z - <Title Case Feature Name>(matches existing releases).
Workflow
- Preflight -
git fetch origin; confirmorigin/mainhas the feature merge; verifyplugin.jsonversionequals the intended vX.Y.Z; check tag/release naming convention. - Sync local main -
git checkout main && git pull --ff-only origin main; set the explicit target withtarget_sha=$(git rev-parse origin/main)and runbash tools/verify-release-sha "$target_sha". - Bump version if needed - if the feature work did not already bump
plugin.json, do it now (Edit tool, BOM-free). - Draft doc entries - add
## X.Y.ZtoCHANGELOG.md(with trailing---separator) and a<release_entry>toRELEASE-NOTES.md, mirroring the previous entry's format exactly; extend the<overview>milestone sentence and the Roadmap. Source bullets from real changes; do not invent. - Commit through a pull request -
git addthe changed files, commit, open a pull request, and merge only after required checks pass. Refreshtarget_shafromorigin/mainand runbash tools/verify-release-sha "$target_sha"before tagging. - Create release + tag - extract the new CHANGELOG section as the release body, append the install line,
gh release create vX.Y.Z --target main --title "vX.Y.Z - <Title>" --notes-file <tmp>. - Verify - tag commit ==
origin/main; release not draft/prerelease; it shows asLatest.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 38 lines · 84 tokens per session scan A c74de55bd36b
cutting-a-release is a skill published in the GitHub repository gustavo-meilus/aiboarding (2 stars, last pushed 11d ago), licensed MIT. It adds 84 tokens to every session and 909 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cut-release
Cut a clean release — bump versions across all files, update changelog, create GitHub release.
release-ops-demo-release-automation
Use when running release automation workflows for release-ops-demo.
taiyi-integration
A project workflow skill for closing a TaiyiForge change and recording it in a CHANGELOG.md file. It checks review results, tests, and the state of the working tree before archiving the change.
release
CONTRIBUTOR TOOL - Cut a plugin release: bump plugin.json version, finalize CHANGELOG, update README if needed, gate on make ci, commit, tag vX.Y.Z, and create the GitHub release. Use when shipping a new plugin version. NOT distributed.
commit-pr
Mandatory Codex/Copilot publication adapter for opencode-swarm. Use for every GitHub issue assignment that results in code changes, commits, pushes, draft PRs, PR body edits, PR readying, release notes, or CI closeout. Must be loaded before git push, gh pr create, gh pr edit, or gh pr ready. Routes to the single…
no-mistakes
Validate committed feature-branch changes through the no-mistakes pipeline: intent, rebase, review, test, docs, lint, push, PR, and CI. Use when the user asks to run no-mistakes, ship safely, validate before pushing, or gate a change before it reaches upstream.