Borrowing it
Nothing to install: this file belongs to ibuilder/massing. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ibuilder/massing/main/.claude/skills/ship-release/SKILL.mdgit clone --depth 1 https://github.com/ibuilder/massingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ibuilder/massing/ship-release)<a href="https://agentmods.dev/skills/ibuilder/massing/ship-release"><img src="https://agentmods.dev/badge/skills/ibuilder/massing/ship-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ibuilder/massing/ship-release"><img src="https://agentmods.dev/badge/skills/ibuilder/massing/ship-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 18 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.02265 |
| Opus 5.5 | $0.00030 | $0.00906 |
| Sonnet 5.5 | $0.00015 | $0.00453 |
| Haiku 4.5 | $0.00007 | $0.00227 |
Grade A, and why
ship-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 134 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ship a Massing release
Standing directions for this repo: docs/roadmap-directions.md. Read those first.
main is unprotected and ships version-numbered releases via direct commits (no PR gate). Each shippable change is its own release. Follow this exactly.
1. Verify before you ship
- Backend (services/api, services/data): run the affected
test_*.py(see thebackend-testsskill) and ruff exactly as CI does:
A file-levelcd services/api && python -m ruff check src/ ../data/src/ruff check <file>from elsewhere does NOT pick upservices/api/ruff.toml(isort/I001) and gives false "passed". Preferruff check --fixto auto-sort imports; put third-party imports in their own group after stdlib. - Web (apps/web):
export PATH="/c/Program Files/nodejs:$PATH"thennpm run typecheck && npm run lint && npm run build(Node 24; Node 18 breaks the build). Runnpx vitest run <path>if unit tests cover the change. - Frontend UI: the dev-preview geometry loader stalls at "preparing geometry", so verify rail UI via the
verify-frontendskill (forcebuildToolsPanelby dispatchingaec:persona), and flag any flow you couldn't exercise end-to-end.
2. Bump the version — THREE files, and the third is not edited by hand
git fetch origin --quiet # avoid the version race (a background release may have taken the next number)
sed -i 's/"version": "0.3.X"/"version": "0.3.Y"/' apps/web/package.json apps/web/src-tauri/tauri.conf.json
cd apps/web && npm install --package-lock-only --ignore-scripts && cd - # re-syncs package-lock.json
package-lock.json carries the version too — twice, at the root and under
packages["apps/web"] — and versionConsistency.test.ts asserts all of them agree. This step said
"BOTH files" until 2026-07-29, when a release ran the two seds and went red on a lock nobody had
mentioned. Regenerating the lock is the fix rather than a third sed: hand-editing it would sync the
number while leaving whatever else the bump touched stale.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 134 lines · 74 tokens per session scan A 18a112dc92e4
ship-release is a skill published in the GitHub repository ibuilder/massing (132 stars, last pushed today), licensed MIT. It adds 74 tokens to every session and 2,265 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
tauri-impl-build-deploy
Use when building for production, configuring installers, setting up code signing, or creating CI/CD pipelines. Prevents unsigned builds being rejected by OS gatekeepers and missing resource files in bundled installers. Covers tauri build command, platform bundlers (NSIS/MSI/DMG/AppImage/deb), sidecars, code signing…
ara3d-sdk
Use when processing AEC/BIM 3D data in .NET 8 — mesh generation and transformation, SIMD-accelerated math, IFC/STEP/PLY to glTF/GLB/VIM conversion, plugin development. Ara3D-SDK: high-performance .NET 3D geometry and BIM library suite.
elements
Use when generating building information models (BIM) programmatically in C#/.NET — wall, beam, column, floor creation, geometry kernel (BREP/CSG), glTF/IFC/JSON serialization, MEP systems, spatial grids. Hypar Elements: the smallest useful BIM — a cross-platform C# library for creating building elements without…
release
Fully automate a release with version-bump and childhood.
release-notes
Generate user-facing release notes from tickets, PRDs, or changelogs. Creates clear, engaging summaries organized by category (new features, improvements, fixes). Use when writing release notes, creating changelogs, announcing product updates, or summarizing what shipped.
multi-agent-release-manager
Cleans up the workspace, formats code, runs presubmit checks, and uploads CLs to Gerrit.