Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add joslat/maf-doctor --skill maf-release-watchergit clone --depth 1 https://github.com/joslat/maf-doctorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joslat/maf-doctor/maf-release-watcher)<a href="https://agentmods.dev/skills/joslat/maf-doctor/maf-release-watcher"><img src="https://agentmods.dev/badge/skills/joslat/maf-doctor/maf-release-watcher/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/joslat/maf-doctor/maf-release-watcher"><img src="https://agentmods.dev/badge/skills/joslat/maf-doctor/maf-release-watcher.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00124 | $0.03157 |
| Opus 5 | $0.00062 | $0.01579 |
| Sonnet 5 | $0.00025 | $0.00631 |
| Haiku 4.5 | $0.00012 | $0.00316 |
Grade A, and why
maf-release-watcher scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 199 lines — stays where its author put it; the contents beside it link to each section on GitHub.
maf-release-watcher
Purpose
When Microsoft ships a new MAF version, this pipeline keeps the toolkit's three artefacts current with zero manual baseline-update work:
.maf-version— the tracked-current pointerdocs/compatibility-matrix.md— dependency-version table (new row per release)guides/maf-X.Y.Z-migration-guide.md— per-version delta with banner pointing back to the chainguides/maf-current-migration-guide.md— auto-regenerated cumulative reference.github/skills/maf-obsolete-api-registry/registry.yaml— append-only breaking-change registry
Two of those (compatibility-matrix.md row contents, per-version guide TODO sections, registry-entry TODO fields) require judgement the deterministic pipeline can't fully automate — release notes have to be interpreted, before/after C# examples written, etc. That work is delegated to GitHub Copilot Coding Agent via a second workflow (maf-ai-fill-todos.yml) that opens an issue with a structured prompt and assigns the bot.
When this skill is "invoked"
It isn't, in the Copilot-Chat sense. The work runs in GitHub Actions VMs, not in a Copilot conversation. This skill is the reference doc explaining what those workflows do, so a maintainer reading the repo can understand the whole loop without piecing it together from two .yml files plus three Python scripts.
Triggers for the pipeline itself:
- Weekly cron:
0 6 * * 4(Thursday 06:00 UTC) — defined in.github/workflows/maf-release-watcher.yml - Manual dispatch:
gh workflow run maf-release-watcher.yml -f maf_version=X.Y.Z
Architecture — the three stages
TRIGGER (cron or gh workflow run)
│
▼
┌────────────────────────────────────────────────────────────────────┐
│ STAGE 1 — Deterministic data extraction │
│ .github/workflows/maf-release-watcher.yml │
│ Runs on a fresh Ubuntu VM provisioned by GitHub Actions │
│ NO LLM, NO AGENT — just shell + Python + dotnet CLI │
├────────────────────────────────────────────────────────────────────┤
│ │
│ 1.1 Select oldest untracked MAF stable from NuGet │
│ (clean no-op while any watcher scaffold PR is in flight) │
│ 1.2 Resolve + diff the targeted release-critical package surfaces│
│ 1.3 Fetch GitHub release notes from microsoft/agent-framework │
│ 1.4 Run `python3 .github/scripts/update_compat_matrix.py` │
│ → inserts a new row at the top of compatibility-matrix.md │
│ 1.5 Run `python3 .github/scripts/gen_guide_section.py` │
│ → writes guides/maf-X.Y.Z-migration-guide.md │
│ → ALSO regenerates guides/maf-current-migration-guide.md │
│ 1.6 Run `registry-extract --diff-file` for validated surfaces │
│ → scoped drafts, no second network diff, then de-duplicate │
│ 1.7 Update .maf-version │
│ 1.8 Upload plan/diff+extraction ledgers/diff-*.txt/notes │
│ as workflow artefacts for reviewer audit │
│ 1.9 git checkout -b release-watcher/maf-X.Y.Z │
│ git commit + git push (per-version branch, NOT main) │
│ 1.10 gh pr create --base main --head release-watcher/maf-X.Y.Z │
│ (2026-06-28 "C" refactor — an unfilled scaffold turned │
│ main RED and blocked every downstream PR; Stage 1 now │
│ always opens a PR instead of committing direct-to-main. │
│ No longer auto-dispatches Stage 2 below — that's now a │
│ maintainer's manual, optional next step, targeting the │
│ branch this PR is on.) │
│ │
└────────────────────────────────────────────────────────────────────┘
│ manual, optional
▼
┌────────────────────────────────────────────────────────────────────┐
│ STAGE 2 — AI-fill dispatch (manual, optional) │
│ Maintainer runs: gh workflow run maf-ai-fill-todos.yml │
│ -f target_version=X.Y.Z │
│ .github/workflows/maf-ai-fill-todos.yml │
│ Runs on ANOTHER fresh Ubuntu VM │
│ Still no LLM — just creates an issue + assigns Copilot │
├────────────────────────────────────────────────────────────────────┤
│ │
│ 2.1 Ensure `maf-release` and `ai-fill` labels exist (idempotent) │
│ 2.2 Open a GitHub issue: │
│ - Title: "Fill TODOs for MAF X.Y.Z" │
│ - Body: full filling prompt (the prompt the maintainer │
│ wrote — what to fill, style anchor, constraints) │
│ - Labels: maf-release,ai-fill │
│ 2.3 Assign Copilot Coding Agent via GraphQL │
│ - bot ID: BOT_kgDOC9w8XQ (stable across all repos) │
│ - mutation: addAssigneesToAssignable (additive) │
│ (gh CLI's --assignee doesn't work — REST `/users/Copilot` │
│ doesn't return the bot. GraphQL does.) │
│ │
└────────────────────────────────────────────────────────────────────┘
│ issue assignment
▼
┌────────────────────────────────────────────────────────────────────┐
│ STAGE 3 — GitHub Copilot Coding Agent │
│ Runs on GitHub's own infrastructure (NOT our workflow VM) │
│ THIS is the LLM/agent part │
├────────────────────────────────────────────────────────────────────┤
│ │
│ 3.1 Reads the issue body (the prompt) │
│ 3.2 Reads the repo (registry.yaml, matrix, guide, release notes) │
│ 3.3 Creates a branch (e.g. copilot/fill-todos-for-maf-1-4-0) │
│ 3.4 Makes file edits — fills the TODOs: │
│ - registry: fix_description, example_before/after, │
│ guide_section (N/A if no parallel in 1.3 guide) │
│ - compat matrix: real version constraints if release │
│ notes mention them, else `unknown` + TODO comment │
│ - per-version guide: Breaking Changes, New Patterns, │
│ Obsolete APIs, Known Misalignments sections │
│ - clean up terminal-escape artefacts in diff summary │
│ 3.5 Opens a draft PR titled │
│ "chore: AI-filled TODOs for MAF X.Y.Z" │
│ labelled `maf-release,ai-fill` │
│ │
└────────────────────────────────────────────────────────────────────┘
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 199 lines · 124 tokens per session scan A 6757a90ab537
maf-release-watcher is a skill published in the GitHub repository joslat/maf-doctor (14 stars, last pushed 25d ago), licensed MIT. It adds 124 tokens to every session and 3,157 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Release Notes Generator
Generate professional software release notes from a commit log: classify changes, write user-facing summaries, draft a publishable announcement, and assess release readiness. Use for release, changelog, version, and deploy requests.
pinned-release-checklist
Minimal guidance-only Skill used by release-pinned compatibility examples.
Release Checklist
Check release readiness and record a release note. Use for release and rollback requests.
Release Readiness Reviewer
Reviews a release candidate and produces a go/no-go readiness decision.
release
Prepare and publish Perigon.CLI patch releases, including versioning, release notes, bilingual docs, validation, and the nuget-branch CI handoff.
release-notes
Generate release notes from git history and CHANGELOG. Formats for GitHub Release, Slack, or email. Use before tagging a release.