Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/innocarpe/CarpeOSnpx agentmods add skills/innocarpe/carpeos/carpeos-releaseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/innocarpe/carpeos/carpeos-release)<a href="https://agentmods.dev/skills/innocarpe/carpeos/carpeos-release"><img src="https://agentmods.dev/badge/skills/innocarpe/carpeos/carpeos-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/innocarpe/carpeos/carpeos-release"><img src="https://agentmods.dev/badge/skills/innocarpe/carpeos/carpeos-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00107 | $0.02251 |
| Opus 5.5 | $0.00043 | $0.00900 |
| Sonnet 5.5 | $0.00021 | $0.00450 |
| Haiku 4.5 | $0.00011 | $0.00225 |
Grade A, and why
carpeos-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 227 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CarpeOS Release (shared harness skill)
Same workflow for Claude Code, Codex CLI, Grok Build, and Gajae Code/GJC.
Do not invent alternate version schemes, ad-hoc npm publish, or untagged releases.
Canonical policy (read when unsure):
docs/maintainers/versioning-and-releases.mddocs/maintainers/major-release-surface.md(required for every MAJOR)CHANGELOG.mdscripts/release.mjs.github/workflows/release.yml- checker:
node scripts/check-major-release-surface.mjs
When to use
Trigger on: release, version bump, npm publish, git tag, GitHub Release,
@innocarpe/carpeos, ship package, cut v0.x.y, SemVer.
Hard rules (all agents)
- One public version line: only
@innocarpe/carpeos(packages/carpeos/package.json). - Tag format:
vX.Y.Zmust equal packageversion. - No silent publish: never
npm publishwithout a matching planned tag/version unless user explicitly demands emergency fallback. - Changelog required: every release has a
## [X.Y.Z] - YYYY-MM-DDsection. - Push is explicit:
scripts/release.mjscommits + tags locally; you must get user OK beforegit push origin mainandgit push origin vX.Y.Z(unless user already authorized release end-to-end). - No private data in changelog or release notes (paths, tokens, real projects).
- Pre-1.0 (
0.y.z): breaking CLI/MCP/setup changes → MINOR +### Breakingin changelog (not a quiet patch). - Completion requires local activation: npm and GitHub publication are not a complete public release until the exact published version is installed and exercised in the maintainer's real local environment; record the commands and results in the release receipt.
- MAJOR is not complete without the docs surface: for
X.0.0(or any product thesis major), update and verify the checklist indocs/maintainers/major-release-surface.md(README EN/KO, package README, PRD index +PRD-vX,product-X.0.0.md, architecture overview, versioning banner). Runnode scripts/check-major-release-surface.mjs. Do not report “major complete” after tag/npm alone if that surface is stale.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 227 lines · 107 tokens per session scan A 3a441167215d
carpeos-release is a skill published in the GitHub repository innocarpe/CarpeOS (1 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 107 tokens to every session and 2,251 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
release-slice
Open-source one slice of a private system: take a component, sanitize it, run a leak-scan as a hard gate, publish to GitHub, then changelog, roadmap and tag on cadence, then the content wave. Publishing without passing the leak-scan is forbidden. Triggers: "/release-slice ", "ship the next slice".
release-rollback
A release and rollback checklist for code or scripts, covering readiness checks, release decisions, and recovery after an incident.
ll-fork-guide
A development guide for maintaining a fork, which is a separate version of an existing software project, of DeepSeek-Reasonix.
ll-iteration-dev
A workflow for developing several tasks in parallel using separate Git worktrees, which are independent working directories for one repository.
release-notes
Draft short release notes from a list of changes. Use when the user asks for changelogs, release notes, or a concise product update.
git-wrapup
Land working-tree changes as logical commits — the work grouped by concern, topped by a release commit (version bump, changelog, regenerated artifacts). The work commits land first, then the version bump, verification, and the release commit on top. Stops at "committed locally on main" — or, when the project releases…