jezweb/claude-skills is a collection of skills, commands, plugins, settings, instructions, and hooks that guide the Claude Code CLI through development tasks and produce outputs such as project scaffolds, assets, documents, or deployed services. It is for developers using Claude Code with technologies and services including Cloudflare, React, Tailwind, Shopify, and WordPress. The catalogue entries are the project's own Claude Code workflow components.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jezweb/claude-skills --skill github-releasegit clone --depth 1 https://github.com/jezweb/claude-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jezweb/claude-skills/github-release)<a href="https://agentmods.dev/skills/jezweb/claude-skills/github-release"><img src="https://agentmods.dev/badge/skills/jezweb/claude-skills/github-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jezweb/claude-skills/github-release"><img src="https://agentmods.dev/badge/skills/jezweb/claude-skills/github-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 34 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.00991 |
| Opus 5.5 | $0.00026 | $0.00396 |
| Sonnet 5.5 | $0.00013 | $0.00198 |
| Haiku 4.5 | $0.00006 | $0.00099 |
Grade A, and why
github-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Release
Sanitize and release projects to GitHub. Two-phase workflow: safety checks first, then tag and publish.
Prerequisites
ghCLI installed and authenticated (gh auth status)gitleaksinstalled for secrets scanning (brew install gitleaksor download from GitHub)- Git repository with a remote configured
Workflow
Phase 1: Sanitize
Run these checks before any public release. Stop on blockers.
1. Scan for Secrets (BLOCKER)
gitleaks detect --no-git --source=. --verbose
If secrets found: STOP. Remove secrets, move to environment variables. Check git history with git log -S "secret_value" — if in history, use BFG Repo-Cleaner.
If gitleaks not installed, do manual checks:
# Check for .env files
find . -name ".env*" -not -path "*/node_modules/*"
# Check config files for hardcoded secrets
grep -ri "api_key\|token\|secret\|password" wrangler.toml wrangler.jsonc .dev.vars 2>/dev/null
2. Remove Personal Artifacts
Check for and remove session/planning files that shouldn't be published:
SESSION.md— session stateplanning/,screenshots/— working directoriestest-*.ts,test-*.js— local test files
Either delete them or add to .gitignore.
3. Validate LICENSE
ls LICENSE LICENSE.md LICENSE.txt 2>/dev/null
If missing: create one. Check the repo visibility (gh repo view --json visibility -q '.visibility'). Use MIT for public repos. For private repos, consider a proprietary license instead.
4. Validate README
Check README exists and has basic sections:
grep -i "## Install\|## Usage\|## License" README.md
If missing sections, add them before release.
5. Check .gitignore
Verify essential patterns are present:
grep -E "node_modules|\.env|dist/|\.dev\.vars" .gitignore
6. Build Test (non-blocking)
npm run build 2>&1
7. Dependency Audit (non-blocking)
npm audit --audit-level=high
8. Create Sanitization Commit
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 153 lines · 65 tokens per session scan A 6c7e72bed969
github-release is a skill published in the GitHub repository jezweb/claude-skills (1,070 stars, last pushed 10d ago), licensed MIT. It adds 65 tokens to every session and 991 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
release-notes
Draft short release notes from a list of changes. Use when the user asks for changelogs, release notes, or a concise product update.
release-skills
A release workflow for preparing and publishing a new version of a software project. A release is a named version that may include updated version files, release notes, tags, or a GitHub Release.
version-release
Choose and apply the correct semantic version bump for this repository. Use for every user-visible release, before merge when a change set should ship as patch, minor, or major, and whenever package/plugin/desktop version metadata must stay synchronized.
changelog-gen
A changelog generator that turns Git history into a version-by-version record of project changes. A changelog is a readable summary of new features, fixes, breaking changes, documentation, and other updates.
changelog-generator
Convierte un git log, lista de commits o notas de lanzamiento en un changelog pulido orientado al usuario. Usa cuando estés escribiendo notas de versión, generando una entrada en CHANGELOG.md o documentando qué cambió en una versión. Produce una sección de changelog estructurada con encabezado de versión, cambios…
release
CONTRIBUTOR TOOL - Cut a plugin release: bump plugin.json version, finalize CHANGELOG, update README if needed, gate on make ci, commit, tag vX.Y.Z, and create the GitHub release. Use when shipping a new plugin version. NOT distributed.