Paperthin is a collection of low-level design patterns that coding agents can apply as repeatable checks and actions during software work. It is for people using agents such as Claude Code, Codex, Cursor, or other supported tools, and its catalogue entries package the patterns as skills, an instruction, and a plugin.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LilMGenius/paperthin --skill re0-releasegit clone --depth 1 https://github.com/LilMGenius/paperthinWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lilmgenius/paperthin/re0-release)<a href="https://agentmods.dev/skills/lilmgenius/paperthin/re0-release"><img src="https://agentmods.dev/badge/skills/lilmgenius/paperthin/re0-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lilmgenius/paperthin/re0-release"><img src="https://agentmods.dev/badge/skills/lilmgenius/paperthin/re0-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.01694 |
| Opus 5.5 | $0.00016 | $0.00678 |
| Sonnet 5.5 | $0.00008 | $0.00339 |
| Haiku 4.5 | $0.00004 | $0.00169 |
Grade A, and why
re0-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- re0-release — 98% identical
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Run this repo's shipping and releasing checklist on a pending change, then tag and publish once confirmed.
Goal
Make "prepare and ship a release" a single deliberate command instead of re-deriving the shipping and releasing checklist by hand every time. It runs sip when installed, applies commit-economy directly, and never auto-fires another user-invoked skill. It treats "commit" and "tag + push" as two separately-staked moments: a commit stays local and reversible, tag + push is the one step that goes public.
Workflow
- Confirm shipping readiness against the pending diff — every applicable item from AGENTS.md's Shipping checklist except the version bump and the
siprun, which are steps 2 and 3 here:- any new or changed
SKILL.mdhas the right shape (frontmattername+description,disable-model-invocationonly if user-invoked, body sections Goal/Workflow/Rules/Verification); - the README and every localized copy under
docs/readme/list it accurately, with the right invocation column and in the roster's logical order — the same order held acrossplugin.json,scripts/catalog.cjs, andre0-upgrade's catalog, kept in lockstep withreorder; the README's Problem removes-list and Fixes narrative include it only if it carries the thesis (most skills earn neither — both are curated); plugin.jsonregisters its path;- any rename appends an old -> new row to
re0-upgrade's deprecations checklist, in release order; - shared cross-skill rules (edit-safety, negatives-as-corpus, commit-economy) stay coherent across every copy that carries them. Report any gap and stop rather than guessing past it.
- any new or changed
- Classify the version bump: a new skill is minor; a fix or docs-only change is patch; a skill removed with no replacement path is major. For an enhancement to an existing skill — the boundary case — decide by kind, not size: relative to the skill's own prior spec, was the old behavior wrong (a fix → patch; new plumbing that only serves a fix stays patch) or correct but narrower / missing a dimension (a new capability a user newly reaches for → minor)? State that answer, not just the bump.
- Run
sipif it is installed, and apply its findings. If it is not installed, run its checks directly in order — cold-read (shower), truth checks only when there is a claim or an eval (factchk/mandela), consistency (ssotizeaudit first, consolidation only after approval), then tidy (re0) — and apply what they find. - Bump
package.json's version to the classification from step 2. - Draft the commit message to commit-economy — one bullet per real, durable change with supporting edits folded in, nothing the diff or version already proves, no co-author tags, matched to the local log's own shape or, absent one, a subject and one
-bullet per change on a single unwrapped line — from the first draft, not appended to across edits. If a commit already exists and needs cleanup, ask the human to runre0-git; do not invoke it automatically. - Ask for explicit confirmation, then commit.
- Write
.re0/release/RELEASE_NOTES.local.md— a gitignored, never-shipped local scratch file that rides the signed tag as its message — to this house style: one##heading naming the release's durable idea, not the version; one short present-tense paragraph of what is true now; only the sections the release earns (### New,### Also,### The catalog (N skills)only when the roster needs re-mapping,### Installalways last as an indented block); each externally-contributed change credited inline with its PR number and author handle ((#123, @handle)); skill names and paths in backticks; nothing the tag or version already proves. - Ask for a second, separate confirmation before tagging and pushing — this is the one step that goes public. Then:
git tag -s vX.Y.Z -F .re0/release/RELEASE_NOTES.local.md --cleanup=verbatim, confirmgit tag -v vX.Y.Zreports a good signature, pushmain, push the tag. - Watch the triggered release workflow to completion; report success or the actual failure, never assume it landed. If it failed, fix the cause and re-run it. A tag the author cut wrong (its message, signature or target) is deleted and re-cut at the same version rather than rolled forward to a new one; the version moves on only when a published artifact is wrong. Never finish the workflow's work by hand.
- Once success is confirmed, close out each external contribution the release landed: whoever reviewed it approves the PR before closing it — a contribution squashed or rebuilt into the release is closed, not merged, so the approval is what records it as accepted rather than rejected — and the closing comment carries the credit the release notes gave it. Any collaborator or maintainer with review access can do this; it is not tied to one reviewer.
- Then retire the shipped cycle: move its
.re0/iteration/<version>-<workname>/folder into.re0/iteration/completed/<version>-<workname>/, unrenamed..re0/is gitignored and never tracked, so use a plain filesystem move (mv), nevergit mv— the latter fails outright on an untracked path. Skip this step only when the cycle was never planned withre0-planand has no matching iteration folder.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 23d ago Changed 1b4ad371cdc8
- 1mo ago Changed c897af1c4088
- 1mo ago First seen · 53 lines · 40 tokens per session scan A 001c1dba7568
re0-release is a skill published in the GitHub repository LilMGenius/paperthin (1,329 stars, last pushed yesterday), licensed MIT. It adds 40 tokens to every session and 1,694 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
askit-release
Builds and validates a plugin's release by computing the version, promoting the changelog, curating the release notes, and running the readiness gate, to the Advanced Skill Library Standard. Use when cutting a release, bumping the plugin version, updating the changelog or release notes, or checking release readiness.
release
Cut a release - bump the version in every version file, move the CHANGELOG, commit, tag, push and create the GitHub release, confirming before anything leaves the machine.
git-github
Git commits, GitHub Actions workflows, release tags and changelogs, with a live check that resolves every action version from GitHub. Use when writing or editing a workflow uses: line, bumping or auditing action versions, validating a workflow file, staging or writing a commit message, naming a branch, tagging a…
release-notes
Generate audience-targeted release announcements. Specify the audience (customers, internal team, investors, social media) and optionally a version or scope. Use after shipping to announce what was built.
git-workflow-and-versioning
Structures git workflow practices. Use when making any code change. Use when committing, branching, resolving conflicts, splitting uncommitted work in a messy working tree into clean atomic commits, opening or reviewing a pull request (PR), pushing to a remote, or when you need to organize work across multiple…
skillshare-release
Prepare and review skillshare releases using the Release Please PR, verify the proposed version and changelog, inspect draft assets, and publish through the manual Publish Release workflow when explicitly authorized. Use when the user says "release", "prepare release", "cut a release", or asks to publish a new…