gaia-release

gaia-release is a skill for Claude Code from metraton/gaia. It costs 37 tokens per session (7,036 once invoked), scanned A, original, MIT.

A release process for testing, installing, and publishing Gaia, an agent system. It defines separate flows for local installation, pre-release checks, and official releases.

In plain words
What is it for?
Use it for local installs, release candidates, dry runs, stable releases, plugin releases, and validation after installation.
Why use it?
It reduces mistakes caused by manually remembering version updates, installation steps, validation, or publishing tasks.

Skill for Claude Code

Written for Claude Code: Claude Code plugin machinery. Also seen: mentions Claude Code.

Part of the gaia plugin — 38 skills, 9 agents, 11 hooks shipped together

Good fit Use it for local installs, release candidates, dry runs, stable releases, plugin releases, and validation after installation.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/metraton/gaia/gaia-release
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add metraton/gaia --skill gaia-release
Clone the repo
git clone --depth 1 https://github.com/metraton/gaia

Made for: Claude Code.

Or install gaia, the plugin that ships this one along with the rest of its 38 skills, 9 agents, 11 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for gaia-release

README.md
[![agentmods](https://agentmods.dev/badge/skills/metraton/gaia/gaia-release/github.svg)](https://agentmods.dev/skills/metraton/gaia/gaia-release)
Your own site
<a href="https://agentmods.dev/skills/metraton/gaia/gaia-release"><img src="https://agentmods.dev/badge/skills/metraton/gaia/gaia-release/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for gaia-release

Your own site · 80×15
<a href="https://agentmods.dev/skills/metraton/gaia/gaia-release"><img src="https://agentmods.dev/badge/skills/metraton/gaia/gaia-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 37 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 7,036 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00037 $0.07036
Opus 5 $0.00018 $0.03518
Sonnet 5 $0.00007 $0.01407
Haiku 4.5 $0.00004 $0.00704

Measured 5d ago against content hash 2d7d66cd7d56, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

gaia-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/gaia-release/SKILL.md · 138 lines

How it starts

The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Gaia Release

The norm for getting Gaia onto a machine and into the registry, organized as three layers of increasing confidence. The user expresses exactly one of three intentions -- install local (Layer 1, fast iteration), pre-release (Layer 2, the confidence gate), or release (Layer 3, the official publish) -- and each maps to a complete, automated sequence the orchestrator runs end-to-end. The user never recalls a sub-step and never runs a release script by hand: the script is a tool the flow invokes, not a command the human must remember. This is the lesson of the sagas that shipped broken -- a release failed because a version source was bumped one file at a time and a forgotten pyproject.toml drifted; another needed a force-push to reconcile a tag. Every one of those was a manual step a human was trusted to remember and didn't. The fix is to norm the sequence so the steps cannot be forgotten: they are the flow, not a checklist beside it.

This skill orchestrates the sequence; it does not define what a healthy install looks like. Every layer closes by installing into a target workspace and then validating it -- and "how you validate" lives in gaia-verify, which owns the wire-up checklist and the per-surface checks. When a layer says "verify," it means "run gaia-verify for the matching mode." Keep the two apart: release is the when and in what order; verify is the did it come out right.

The delivery model: one plugin, two distribution channels

Gaia ships as a single plugin named gaia (scripts/build-plugin.py has VALID_PLUGINS = ("gaia",)). The package root IS the plugin, and it is the same tree as the git repo root -- there is no dist/ bundle. That single tree reaches a workspace through two distribution channels, and a change can pass on one while breaking the other:

  • plugin surface (git marketplace source) -- Claude Code consumes the git repository directly: .claude-plugin/marketplace.json advertises the gaia plugin with {"source": "github", "repo": "metraton/gaia"}, so /plugin marketplace add + /plugin install make CC clone the repo into its plugin cache. This is the channel that loads Gaia's agents, skills, and hooks in Claude Code. The git source was adopted (commit a43ef22) precisely because the prior source: npm entry loaded 0 skills on /plugin install -- a confirmed CC gap -- while the identical tree loads all 32 skills via a git/local source. CC loads hooks from the repo root's hooks/hooks.json (the standard plugin convention) -- it does not use settings.local.json for hooks, and the root .claude-plugin/plugin.json is metadata only (no inline hooks block). Hooks are declared in exactly ONE place because CC reads both a plugin.json inline block AND hooks/hooks.json; declaring them in both double-registered every hook and fired every event twice (fixed in a1b1245). Both .claude-plugin/plugin.json and hooks/hooks.json are generated from the manifest (prepack / generate:plugin-root) and tracked in git, so the cloned tree already carries them. Git sources support version pinning by ref/sha, and release:prepare's bumpMarketplace() does exactly that: for github/git sources it sets source.ref = v<version> atomically alongside plugin.version, so /plugin install clones the fixed, reproducible release tag instead of tracking moving default-branch HEAD (npm/local sources carry no ref and are left untouched).
  • CLI / npm surface (npm package @jaguilar87/gaia) -- npm|pnpm install @jaguilar87/gaia (and gaia dev) install the npm package; this is what provides the gaia CLI and the workspace wiring. gaia install then wires the workspace: it symlinks .claude/{agents,tools,hooks,config,skills} (plus a CHANGELOG.md link) to the installed package and merges hook events into settings.local.json. The DB is bootstrapped lazily on first gaia CLI use (_ensure_db_bootstrapped in bin/gaia) -- there is no npm postinstall (removed so the install is non-invasive and works identically under npm and pnpm, which ignores lifecycle scripts by default). This surface reads hooks from the package root's generated hooks/hooks.json (via merge_local_hooks in _install_helpers.py), which is regenerated at pack time from the manifest.

Read the full file on GitHub · 138 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago Changed · +2 lines 2d7d66cd7d56
  2. 10d ago First seen · 136 lines · 37 tokens per session scan A af6e329f8588

Subscribe to this mod's changes

gaia-release is a skill published in the GitHub repository metraton/gaia (3 stars, last pushed today), licensed MIT. It adds 37 tokens to every session and 7,036 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.