Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/javded-itres/holix/make-releasenpx skills add javded-itres/Holix --skill make-releasegit clone --depth 1 https://github.com/javded-itres/HolixWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/javded-itres/holix/make-release)<a href="https://agentmods.dev/skills/javded-itres/holix/make-release"><img src="https://agentmods.dev/badge/skills/javded-itres/holix/make-release.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00077 | $0.01161 |
| Opus 5 | $0.00039 | $0.00580 |
| Sonnet 5 | $0.00015 | $0.00232 |
| Haiku 4.5 | $0.00008 | $0.00116 |
Grade A, and why
make-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Holix release («сделай релиз»)
When the user says сделай релиз (or equivalent), execute this pipeline end-to-end. Do not stop after the PR. Do not skip CI. Do not tag before merge.
Canonical package rules: RULES.md §8. This skill is the operational loop.
Preconditions
- Repo:
javded-itres/Holix. Default branch:main. - Auth:
gh auth statusmust be logged in. - Fetch first:
git fetch origin --tags. - Next version = latest GitHub release + patch (
1.0.7→1.0.8), unless the user asked for minor/major. - Confirm versions agree before tagging:
pyproject.toml[project].versioncli/__init__.py__version__- latest
gh release list/git tag
- Do not rsync/scp/hotfix production. Tag on
mainis enough: GHAGitHub Release+Publish to PyPIrun fromvX.Y.Z. - Run
./scripts/lint.sh(or--fix) before every push.
1) PR with the changes
Include code + version bump + changelog in the same PR so there is one merge, then a tag.
- If an open PR already covers this work, reuse it and add the bump there if missing.
- Otherwise branch from up-to-date
origin/main:release/X.Y.Z(example:release/1.0.8). - Commit the user's uncommitted/unmerged work (no secrets, no
node_modules/, no local.env). - Bump version with
scripts/versioning.py(or edit both files):pyproject.tomlcli/__init__.py
- Update
docs/CHANGELOG.md:- Move
## Unreleasednotes into## X.Y.Z — YYYY-MM-DD - Leave a fresh empty
## Unreleased - Write Added/Fixed/Tests from the actual diff
- Move
- Push and open PR →
main:
gh pr create --base main --title "Holix X.Y.Z" --body "$(cat <<'EOF'
## Summary
Release Holix X.Y.Z.
## Checklist
- [ ] Version matches in pyproject.toml and cli/__init__.py
- [ ] docs/CHANGELOG.md has section X.Y.Z
- [ ] CI green (ruff + pytest matrix)
After merge: tag `vX.Y.Z` (creates GitHub Release + PyPI).
EOF
)"
2) GitHub tests until green
Watch GitHub Actions on the PR, not only local pytest.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 135 lines · 77 tokens per session scan A 4270ca235399
make-release is a skill published in the GitHub repository javded-itres/Holix (13 stars, last pushed today), licensed MIT. It adds 77 tokens to every session and 1,161 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mnemosyne
Persistent cross-session memory via Mnemosyne — store, recall, and consolidate facts, preferences, and context.
flash-attention
Speed up long-sequence transformer training and inference.
hermes-tweet
Use Xquik in Hermes Agent for public X research, monitoring, thread summaries, creator discovery & approved actions. Not affiliated with X Corp. Use when the user requests X data or a named action. Trigger with "search X", "monitor X", "post tweet", or "X trends".
mnemosyne-maintenance
Use when: upgrading Mnemosyne, diagnosing slow/hung consolidation (mnemosynesleep), fixing missing embeddings, or troubleshooting import/version mismatches.
vrc-monitor-agent
Use for VRChat friend queries (online status, who played with whom, activity timelines, online patterns) and VRChat social actions (boop, invite, join world, friend management, group operations, image uploads) via the vrc-monitor MCP server on port 8799.
review-workflow
Use when 审核 PR / issue（判断可合并性、多轮修改复核、参与协作审核）。REST-only、端到端实测、分级反馈的完整审核流程。.