Borrowing it
Nothing to install: this file belongs to Kewton/CommandMate. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Kewton/CommandMate/main/.claude/skills/release/SKILL.mdgit clone --depth 1 https://github.com/Kewton/CommandMateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kewton/commandmate/release)<a href="https://agentmods.dev/skills/kewton/commandmate/release"><img src="https://agentmods.dev/badge/skills/kewton/commandmate/release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kewton/commandmate/release"><img src="https://agentmods.dev/badge/skills/kewton/commandmate/release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 308 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.12207 |
| Opus 5.5 | $0.00014 | $0.04883 |
| Sonnet 5.5 | $0.00007 | $0.02441 |
| Haiku 4.5 | $0.00004 | $0.01221 |
Grade A, and why
release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 737 lines — stays where its author put it; the contents beside it link to each section on GitHub.
リリーススキル
develop でバージョンを上げ、develop → main の PR 経由で main へ反映し、タグ・GitHub Release・develop へのマージバックまでを実行するスキルです。
npm publish は行いません。
.github/workflows/publish.ymlが GitHub Release のpublishedを契機に OIDC（npm Trusted Publishers）で自動 publish します。ローカルには publish 用の認証が無いため、npm publishを手元で実行してはいけません。
使用方法
/release patch # パッチバージョンアップ (0.10.0 → 0.10.1)
/release minor # マイナーバージョンアップ (0.10.0 → 0.11.0)
/release major # メジャーバージョンアップ (0.10.0 → 1.0.0)
/release 1.0.0 # 直接バージョン指定
前提条件
developブランチが最新で、origin/developと同期していること（リリースは develop 基点。main 基点ではない）- 作業ツリーがクリーンであること
- 検証ゲートが通ること（Phase 2-3 参照）。
npm run buildは primary checkout で回さない — 稼働サーバの.nextを壊すため。build の検証はリリース PR の CI が行う
全体の流れ
develop ──PR (squash)──> main ──annotated tag──> GitHub Release 作成
│
└─> publish.yml (OIDC) ──> npm
develop <──merge -s ours── main （祖先復元。squash で切れるため必須）
release/* ブランチは経由しない。 origin/release/v* は v0.5.x までしか存在せず、
release ブランチを切る手順（#1202）は v0.10.0 で廃止されている。publish.yml のトリガーは
on: release: types: [published] ＝ GitHub Release オブジェクトの公開であって、
ブランチへの push ではない。
このスキルは develop からしか実行できない（Phase 1-1 で確認し、それ以外は中断する）。
この手順が「なぜこの形か」
| 事実 | 理由 |
|---|---|
| main へ直接 push しない | .git/hooks/pre-push が protected_branch='main' で拒否する。PR 経由が唯一の経路 |
PR は develop → main |
v0.10.0 以降の実績（#1314 / #1325）。release/vX.Y.Z ブランチを切る旧手順（#1202）は使わない |
| squash マージ | 上記 PR は squash される。その結果 develop の祖先が切れるため、マージバックが必須になる |
マージバックは -s ours |
squash 後は main の tree が develop と同一なので、内容ではなく祖先関係だけを復元する |
CHANGELOG の節は apply で生成 |
エントリは PR ごとの断片（changelog.d/<N>.md）で develop に入る。並列の PR が ## [Unreleased] で衝突しないようにするため（#2641） |
| Release ノートは CHANGELOG 転記 | v0.10.0 以降の実績。--generate-notes は v0.9.1 までの形式 |
アプリ内の「新機能と改善」は release-notes/X.Y.Z.json |
画面の言語（ja / en）に合わせて出すため。CHANGELOG は日本語だけなので、そのままは出せない（2-2b） |
| npm publish しない | publish.yml が Release 契機で自動実行する（OIDC / provenance 付き） |
| リリース後も稼働サーバは旧 bundle のまま | primary checkout で build しないので .next は据え置き。これは正常（Phase 4-7 参照） |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 18d ago Changed · +12 lines 0aa16b51d8e3
- 24d ago Changed · +3 lines 883b94192280
- 1mo ago Changed · +103 lines eee8a9fb0b68
- 1mo ago Changed · +48 lines f13cec50f5c5
- 1mo ago Changed · +22 lines 27516e538df8
- 1mo ago First seen · 549 lines · 36 tokens per session scan A 911b9e7e958f
release is a skill published in the GitHub repository Kewton/CommandMate (44 stars, last pushed today), licensed MIT. It adds 36 tokens to every session and 12,207 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
release
Publish a herdr-gpui release. Use when the user asks to cut, push, ship, or publish a release, or to approve, verify, or GPG-sign one that is already running. Covers just release, the protected environments the run stops at, and the local verification and signing steps that are not part of CI.
release-announcement
Write a release announcement — changelog, blog post, in-app note, or social post — that leads with user impact, names the audience, and includes upgrade/migration steps without filler.
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.
gh-credit-harvest
Harvest one community PR into a release branch with authorship and credit preserved, verified green, and a warm thank-you.
release
Skill "release" from Hmbown/Codewhale, covering release, invocation, non-goals and workflow.
release-notes-check
Check a supplied release note for its owner and rollback note.