Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kyh/vibedgames/releasenpx skills add kyh/vibedgames --skill releasegit clone --depth 1 https://github.com/kyh/vibedgamesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kyh/vibedgames/release)<a href="https://agentmods.dev/skills/kyh/vibedgames/release"><img src="https://agentmods.dev/badge/skills/kyh/vibedgames/release.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00105 | $0.01787 |
| Opus 5 | $0.00053 | $0.00894 |
| Sonnet 5 | $0.00021 | $0.00357 |
| Haiku 4.5 | $0.00011 | $0.00179 |
Grade C, and why
release scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- All ship `dist/` built by `tsc`. All three keep `tsBuildInfoFile` at `.cache/tsbuildinfo.json` — NEVER inside `dist/` (it would ship in the tarball; vibedgames ≤0.3.0 did exactly that). Consequence: `rm -rf dist` alone How it starts
The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Release
Cut a new npm version of one or more publishable packages in this repo.
Context
- Repo root:
/Users/kyh/Documents/Projects/vibedgames - Publishable packages (path = where commits "count" for change detection):
vibedgames→apps/cli→ tag prefixvibedgames@@vibedgames/multiplayer→packages/multiplayer→ tag prefix@vibedgames/multiplayer@@vibedgames/gamepad→packages/gamepad→ tag prefix@vibedgames/gamepad@
- All ship
dist/built bytsc. All three keeptsBuildInfoFileat.cache/tsbuildinfo.json— NEVER insidedist/(it would ship in the tarball; vibedgames ≤0.3.0 did exactly that). Consequence:rm -rf distalone makestscsilently emit NOTHING (cache says up-to-date). Always remove bothdistand.cache. vibedgamesand@vibedgames/multiplayerhave no internal workspace consumers.@vibedgames/gamepadIS consumed in-repo by the example games viaworkspace:^, butpnpm publishrewrites that to the published version automatically — no manual downstream sync needed.- Current branch: !
git -C /Users/kyh/Documents/Projects/vibedgames rev-parse --abbrev-ref HEAD - Working tree: !
git -C /Users/kyh/Documents/Projects/vibedgames status --short
Arguments
Parse from the user message:
- Which package(s):
cli,multiplayer,gamepad, orall(bothis still accepted as an alias for cli + multiplayer). Defaultall. - Bump type:
patch,minor,major. Defaultpatch. --forceto release even if no changes since last tag (otherwise unchanged packages are skipped).
If ambiguous, ask in one short sentence before proceeding.
Process
1. Preflight
Run in parallel:
npm whoami— must bekaiyuhsu. If not, stop and tell the user tonpm login.git status --porcelain— if dirty in unrelated files, surface and ask whether to proceed.npm view <pkg> versionfor each candidate (vibedgames,@vibedgames/multiplayer,@vibedgames/gamepad) — current published.- For each candidate package, find its last release tag and check for changes:
If the log is empty andLAST=$(git tag --list '<tag-prefix>*' --sort=-v:refname | head -1) git log --oneline ${LAST:+$LAST..}HEAD -- <pkg-path>--forcewas not passed, drop that package from the release set with a note. Release whatever remains — a single changed package (e.g. only@vibedgames/gamepad) still ships. Stop only if every candidate drops (nothing to release).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 139 lines · 105 tokens per session scan C 7f78972c3f5b
release is a skill published in the GitHub repository kyh/vibedgames (55 stars, last pushed today), licensed MIT. It adds 105 tokens to every session and 1,787 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
supabase
Use when doing ANY task involving Supabase: Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues, supabase-js, @supabase/ssr, RLS, schema migrations, CLI, MCP server. Includes security checklist.
react-hook-form
Correct React Hook Form usage anywhere in the monorepo — data flow, subscriptions, reset, dirty state, number inputs, and controlled-input rules. Load this BEFORE writing or modifying ANY form code, adding a field to an existing form, touching watch/useWatch/formState/getValues/setValue/reset, wiring a form into a…
safe-sql-execution
Use whenever code will build, return, fetch, or execute SQL that runs against a user's real Postgres database — even when the request reads like an ordinary feature or bug fix and never says "security," "injection," or "SafeSqlFragment." This covers: writing or editing any pg-meta function, query builder, or endpoint…
clickhouse-logs-queries
Write, review, and migrate Supabase logs queries against the ClickHouse-backed logs table (the logs.all.otel analytics endpoint). Use this whenever a task involves Logs Explorer SQL, the logattributes map, querying a log source (edgelogs, postgreslogs, authlogs, etc.), translating an old BigQuery cross join…
studio-testing
Testing strategy for Supabase Studio. Use when writing tests, deciding whether a change needs tests and which type, extracting logic from components into testable utility functions, or reviewing test coverage. Covers unit tests, component tests, and E2E test selection criteria.
studio-queries
React Query conventions for data fetching in Supabase Studio. Use when writing or reviewing query hooks, mutation hooks, or query keys in apps/studio/data/ — including adding the first fetch or mutation for a new API endpoint or resource. Covers queryOptions pattern, keys.ts structure, mutation hook template, and…