Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HananxR/Tadado --skill tadado-releasegit clone --depth 1 https://github.com/HananxR/TadadoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hananxr/tadado/tadado-release)<a href="https://agentmods.dev/skills/hananxr/tadado/tadado-release"><img src="https://agentmods.dev/badge/skills/hananxr/tadado/tadado-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hananxr/tadado/tadado-release"><img src="https://agentmods.dev/badge/skills/hananxr/tadado/tadado-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00134 | $0.06077 |
| Opus 5.5 | $0.00054 | $0.02431 |
| Sonnet 5.5 | $0.00027 | $0.01215 |
| Haiku 4.5 | $0.00013 | $0.00608 |
Grade A, and why
tadado-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 369 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Tadado2 发布流程
本 skill 服务的是这个仓库：把「代码改完了」变成「用户手上有一个新安装包，仓库也同步了」。
⚠️ 动手前先读两份东西：仓库根的
CLAUDE.md（项目约定与命令）与TODO.md末尾两条 （最近这轮做了什么、有没有留下没做完的事）。它们比本文件更贴近当下。
一次发布 = 五步
| # | 做什么 | 能不能跳 |
|---|---|---|
| 1 | 验收：npm run e2e（+ 动过帮助文档时 npm run check:help） |
动过 desktop/ 或 resources/skill/** 就不能跳 |
| 2 | 打包：签名环境变量 + npm run tauri build + npm run updater:manifest + 便携 zip + 迁移 skill 的 zip |
同上；没动代码可以跳 |
| 3 | 提交：git add + 一次 commit |
不能（有改动就得提交） |
| 4 | 推送：git push、tag、gh release create |
用户明确说推才推 ← 见铁律 |
| 5 | 同步 skill：仓库 → 本机 .claude/skills/ |
动过 resources/skill/ 就不能跳 |
铁律（这一节比后面所有步骤都重要）
- 推送是用户的动作，不是你的。
git push、gh release create必须在用户明确要求后才做。 用户只说「提交」时，做到 commit 为止，然后把该敲的推送命令原样打给他，不要自己补上。 - 绝不 force push ——
--force、--force-with-lease都不行，main上尤其不行。 （main在 GitHub 上已经开了分支保护：Block force pushes+Restrict deletions， enforcement = Active。真去 force push 会被远端拒掉 —— 但别把它当挡箭牌，本地这一层也要守住； 也不要为了绕开它去点Allow force pushes。） - 绝不
--no-verify。hook 拦下来就去看为什么，不要绕过。 - 绝不改
git config（用户名、邮箱、remote 一个都不动）。 --amend只在用户明确要求时用；用之前先git log -1 --format='%an %ae'确认那条提交是自己的。- 不把安装包提交进 git：
desktop/src-tauri/target/、desktop/dist/、node_modules/、*.exe/*.msi一律不进仓库（三个产物加起来 14 MB，仓库不该背）。安装包走 Release。 - 提交之前，先让用户看见要提交什么：给出
git status --short与git diff --stat的摘要， 等他确认，再 commit。不要自己决定「这些看起来都是我的改动」就一把梭。 - 工作区里混着别人或上一轮的改动时（这个仓库很常见），先问哪些该一起提交， 不要替用户挑 —— 挑错的代价是一条提交里混进不相干的改动。
步骤 1：验收
cd desktop
npx tsc --noEmit # 几秒，先把编译错误挡在前面
npm run e2e # 构建 + 真浏览器冒烟，约 100–110s
npm run check:help # 改过功能 / 关于分组 / 内置操作说明时必跑
- e2e 必须全绿（
全部通过，末尾没有FAIL行）。红了就先修，不要带着红去打包。 - 顺手记下通过条数（
OK: N行数）—— 它突然少了说明有断言没被跑到，值得看一眼。 - 不要为了「快点」只跑
tsc就往下走：这个仓库栽过好几次「类型合法、点下去没反应」。 - 改了功能就同步帮助文档：
desktop/src-tauri/resources/help/index.html随程序分发， 是用户手上那份「帮助文档」。页面名、快捷键、功能清单、当前版本任一变化都要改它， 再跑npm run check:help（它会拦住过期文案与已撤掉的能力）。截图重跑node resources/screenshots.mjs，且只允许来自演示空间样例。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +41 lines dcf41c2c9ce1
- 1mo ago First seen · 328 lines · 134 tokens per session scan A 3265be08a41f
tadado-release is a skill published in the GitHub repository HananxR/Tadado (34 stars, last pushed 6d ago), licensed MIT. It adds 134 tokens to every session and 6,077 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-22.
Other skills, from other repositories
release
Release preparation workflow - security audit → E2E tests → review → changelog → docs.
release-pr-quality-gate
Build an AgentWorks release or pull-request browser quality gate over saved suites and exact build identity. Use when a merge, deployment, or promotion needs an auditable QA decision.
dev-ship
Fechamento de feature — verificação goal-backward antes de declarar pronto. Roda Must-Haves do PLAN.md, executa o demo script, revisa o diff completo procurando bugs e restos (debug logs, TODOs, código morto), passa lente de segurança nos arquivos tocados, escreve SUMMARY.md e arquiva o plano. Use quando o usuário…
release-validation
The final "Green Light". Checks all test suites (Unit, Int, E2E) and third-party reports.
test-next-release
Smoke-test the @next npm release against the petstore example — installs globally, sets up session auth, and verifies all CRUD operations work end-to-end.
flatpak-screenshots
How to request and retrieve Flatpak app screenshots from the e2e workflow. Load when configuring screenshotflatpaks or writing release workflows that consume screenshots.