Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jamesgray-ai/handsonai-plugins --skill publishing-pluginsgit clone --depth 1 https://github.com/jamesgray-ai/handsonai-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jamesgray-ai/handsonai-plugins/publishing-plugins)<a href="https://agentmods.dev/skills/jamesgray-ai/handsonai-plugins/publishing-plugins"><img src="https://agentmods.dev/badge/skills/jamesgray-ai/handsonai-plugins/publishing-plugins/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jamesgray-ai/handsonai-plugins/publishing-plugins"><img src="https://agentmods.dev/badge/skills/jamesgray-ai/handsonai-plugins/publishing-plugins.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00172 | $0.05500 |
| Opus 5.5 | $0.00069 | $0.02200 |
| Sonnet 5.5 | $0.00034 | $0.01100 |
| Haiku 4.5 | $0.00017 | $0.00550 |
Grade A, and why
publishing-plugins scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 311 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Publishing Plugins
Publish skills and agents from the source repository, where they're built and changed, to a
separate plugin repository that teammates install in Claude. Skills and agents live once, in the
source repository's .claude/skills/ and .claude/agents/. The plugin repository can hold several
plugins (one per team, for example), and a release plan in it records which skills and agents go
into each plugin, or which are kept just for the user. Nothing reaches a team until someone decides
it should, and every release of a plugin gets a new version number.
The script scripts/publish-plugin.sh does the copying, the release plan and the version numbers. It
needs Bash and Git on the user's own computer: built into macOS; on Windows, Git for Windows (which
brings Git Bash). It runs where Claude works on the user's computer: Claude Code, including the Code
tab in the Claude desktop app. If you can't run commands on the user's computer, or git isn't
installed, say so plainly and stop: "Publishing needs to run on your own computer. Open the Code tab
in the Claude desktop app, choose this folder, and say 'publish my plugin' there." Where bash is
missing but git works, follow references/by-hand.md.
The leader never types a path, a Git command or a file name. You find folders, run commands, and play back what you found in plain words for them to confirm.
Workflow
Run the script with bash <this skill's folder>/scripts/publish-plugin.sh <command> --plugin-repo <plugin folder>.
Pass paths with forward slashes, on Windows too.
Entry. Find the plugin repository: look in the current folder, then in its parent folder's other
folders, for a .publish-plugin file. If one names the current folder (or the folder the user
mentioned) as its source=, this is a release:
- If the plugin repository has a GitHub connection and GitHub already holds a release
(
git -C <plugin folder> ls-remote --heads originprints something), rungit -C <plugin folder> pull --ff-onlyso you start from the latest release. If that fails, show what Git said and stop. - Run
listand say in one line what you found (if it marks a version "not yet on GitHub", say that too): "Your source repository is my-ai-work; your plugin repository acme-plugins holds sales-team-skills (version 1.0.2)." - If the user asked to add a plugin or move a skill, do Phase 2 for that. Then go to Phase 3.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +42 lines cb252c71f2e6
- 4d ago First seen · 269 lines · 172 tokens per session scan A 66c379b6bde9
publishing-plugins is a skill published in the GitHub repository jamesgray-ai/handsonai-plugins (8 stars, last pushed yesterday), licensed MIT. It adds 172 tokens to every session and 5,500 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-03.
publishing-plugins compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| publishing-pluginsjamesgray-ai/handsonai-plugins | Skill | 8 | yesterday | MIT | A | 172 | Claude Code |
| release-announcementpaperclipai/paperclip | Skill | 111k | yesterday | MIT | A | 42 | Claude Code, Codex |
| releasethedotmack/claude-mem | Skill | 114k | yesterday | Apache-2.0 | A | 13 | Claude Code |
| release-notesphuryn/pm-skills | Skill | 28k | 8d ago | MIT | A | 57 | Claude Code |
| multi-agent-release-managerchromium/chromium | Skill | 25k | yesterday | BSD-3-Clause | A | 27 | Claude Code, Codex |
| pack-submitaeonfun/aeon | Skill | 788 | yesterday | MIT | A | 27 | Claude Code, Codex |
| updater_guidesiddsachar/row-bot | Skill | 1.7k | yesterday | Apache-2.0 | A | 22 | Claude Code, Codex |