taskuary: Skill for Claude Code

.claude/skills/deploy/SKILL.md

deploy is a skill for Claude Code from ldbumble/taskuary. It costs 89 tokens per session (1,103 once invoked), scanned A, original, MIT.

A release procedure for publishing Taskuary to PyPI, Python's package repository. It covers version changes, checks, rebuilding the UI, CI, and tagging the exact commit to publish.

In plain words
What is it for?
Use it to bump the version, run the required gates, commit and push changes, wait for CI, and create the release tag that starts the PyPI upload.
Why use it?
It prevents a release from being published before its checks pass and warns about work from other agents in the same checkout. It also avoids reusing a PyPI version, which is permanent once uploaded.

Skill for Claude Code

Written for Claude Code: installed under .claude/. Also seen: mentions CLAUDE.md.

This is ldbumble/taskuary's own configuration. It tells Claude Code how to work on taskuary itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything taskuary configures →

Reuse

Borrowing it

Nothing to install: this file belongs to ldbumble/taskuary. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/ldbumble/taskuary/master/.claude/skills/deploy/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/ldbumble/taskuary

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for deploy

README.md
[![agentmods](https://agentmods.dev/badge/skills/ldbumble/taskuary/deploy/github.svg)](https://agentmods.dev/skills/ldbumble/taskuary/deploy)
Your own site
<a href="https://agentmods.dev/skills/ldbumble/taskuary/deploy"><img src="https://agentmods.dev/badge/skills/ldbumble/taskuary/deploy/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for deploy

Your own site · 80×15
<a href="https://agentmods.dev/skills/ldbumble/taskuary/deploy"><img src="https://agentmods.dev/badge/skills/ldbumble/taskuary/deploy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 89 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,103 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00089 $0.01103
Opus 5.5 $0.00036 $0.00441
Sonnet 5.5 $0.00018 $0.00221
Haiku 4.5 $0.00009 $0.00110

Measured today against content hash 11ee898ceafe, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

deploy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/deploy/SKILL.md · 63 lines

How it starts

The opening of the file, as written. The whole thing — 63 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Shipping Taskuary

Two separate things, never mixed:

  1. A fix reaches the owner when it is on master - the owner's app runs from the main checkout (the owner's own working copy of the repo, not a worktree), so a push + fast-forward + their restart is "shipped" for them.
  2. A release reaches PyPI when tools/release.sh X.Y.Z.W finishes. That is the only way to tag.

1. Land a fix (minutes, not hours)

  • One fix, one branch, merged to master as soon as its own tests pass: the test files for what it touched, plus npm exec --yes --package=node@22 -- node --test "test/*.test.mjs" (in website/) when website/src changed. Never the full suites locally - CI runs them on parallel machines. Never batch ten branches and integrate at the end: every merge re-runs everything, and a day goes.
  • website/src changed -> rebuild the committed UI before pushing (npm run build, plus build:demo; build:docs when docs/site/*.md or the tool catalog changed - CI's build-web job rejects a stale site/docs).
  • Push, then fast-forward the owner's checkout: git -C <main> merge --ff-only origin/master (only when it is clean). Tell them: restart Taskuary (Python changed) or refresh (UI only).
  • Red CI on master -> fix forward on master at once. tools/ci-failures.sh <run-id|sha> names the failing tests.
  • Agents in parallel: few, on disjoint files, targeted tests only. Five agents each running full suites on one machine made every run slow and every timing test flaky.

2. Release (one command)

From a clean, up-to-date checkout of master:

tools/release.sh 0.3.9.54

It bumps the seven version places (pyproject, both READMEs + their badge asof=, roadmap, docs manifest, the demo's three fixture fields), builds UI/demo/docs, runs the fast gates (node unit, eslint no-undef, version/docs/catalog/timewords pytest), commits, pushes, waits for ci.yml on that exact commit, prints failing tests, reruns failed jobs once (CI's slower machines flake on timing), tags only when green, waits for publish.yml (reruns once - the exe's signing download flakes), verifies PyPI + the GitHub release with Taskuary.exe, and fast-forwards the main checkout. Red twice -> it stops and names the tests: fix them on master, run it again with the same number (it was never tagged).

Read the full file on GitHub · 63 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · -180 lines · -7 tokens per session scan E → A 11ee898ceafe
  2. 6d ago Changed · -1 lines c78f836d8540
  3. 7d ago Changed · -1 lines 8035096709fe
  4. 9d ago Changed · +1 lines 0dda275736fc
  5. 11d ago Changed · +37 lines · +4 tokens per session scan C → E fede8cd450a3
  6. 15d ago Changed · +1 lines 858b7429035d
  7. 18d ago Changed da5babece651
  8. 1mo ago Changed · +1 lines 079cb1c6234e
  9. 1mo ago Changed · +12 lines ab36d5f199ec
  10. 1mo ago First seen · 193 lines · 92 tokens per session scan C 56aba9883759

Subscribe to this mod's changes

deploy is a skill published in the GitHub repository ldbumble/taskuary (143 stars, last pushed today), licensed MIT. It adds 89 tokens to every session and 1,103 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.