Hunk is a terminal application for reviewing code changes created by coding agents, with views for multi-file diffs, inline annotations, and Git-backed reviews. Developers use it to inspect, navigate, and approve changesets from the command line.
Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/modem-dev/hunknpx agentmods add skills/modem-dev/hunk/hunk-releaseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/modem-dev/hunk/hunk-release)<a href="https://agentmods.dev/skills/modem-dev/hunk/hunk-release"><img src="https://agentmods.dev/badge/skills/modem-dev/hunk/hunk-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/modem-dev/hunk/hunk-release"><img src="https://agentmods.dev/badge/skills/modem-dev/hunk/hunk-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 182 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.03507 |
| Opus 5.5 | $0.00015 | $0.01403 |
| Sonnet 5.5 | $0.00008 | $0.00701 |
| Haiku 4.5 | $0.00004 | $0.00351 |
Grade A, and why
hunk-release scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Include both upgrade and npm installation instructions using the exact release: `hunk update <version>` for npm- and curl-managed installs and `npm install -g hunkdiff@<version>` for npm installs or first-time npm user How it starts
The opening of the file, as written. The whole thing — 313 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hunk release workflow
Maintainer-focused and source-checkout only. The tag workflow publishes hunkdiff plus five platform packages, attests the binary archives, and creates the GitHub release.
Safety
- Ask when the version, release branch, previous tag, or channel is ambiguous.
- Get explicit confirmation before pushing a tag, triggering publication, or editing a public release.
- Never reuse an npm version or move a tag after publication.
- Never bypass a benchmark regression without an approved, recorded reason.
- Never retry a partial publish before inventorying every package and artifact.
1. Confirm the release
Record the version, tag, branch, previous tag, and expected channel:
- newer stable: npm
latestand GitHub Latest; - prerelease: npm
beta, not GitHub Latest; - older-series backport: npm
backport-X.Y, leaving both latest pointers unchanged.
For backports, include only commits present between the previous tag and the release tip on that maintenance branch. Inspect .changeset/pre.json before changing prerelease state.
2. Prepare
Start from a clean, current release branch:
git status --short --branch
git fetch origin --tags --prune
git tag --sort=-version:refname | head -10
bun install --frozen-lockfile
bun run changeset:status
Read the pending Changesets, then generate metadata and the published release notes:
bun run release:version
bun run generate:changelog
git diff -- package.json bun.lock packages CHANGELOG.md .changeset website
Verify the intended versions, consumed Changesets, and new changelog section. Do not force a bump by hand-editing generated versions.
generate:changelog projects CHANGELOG.md into hunk.dev/changelog. Never hand-edit its output under website/src/content/docs/changelog/, website/public/changelog/, website/releases/dates.json, or website/releases/latest.json. For a minor or major release, add the hand-authored parts to website/releases/notes.json under the major.minor key and regenerate:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +2 lines c7fe7ead42bd
- 22d ago Changed · +48 lines 204ff7ae4e76
- 1mo ago Changed · +33 lines a89cf85c0641
- 1mo ago First seen · 230 lines · 38 tokens per session scan A 98045bbfff5c
hunk-release is a skill published in the GitHub repository modem-dev/hunk (9,613 stars, last pushed today), licensed MIT. It adds 38 tokens to every session and 3,507 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gh-find-prs
Survey open Codewhale PRs and triage each for mergeability and disposition against the real landing branch.
github
Skill "github" from Hmbown/Codewhale, covering github, when to use, setup, workflow and non-goals.
revdiff
Review diffs, files, and documents with inline annotations in a TUI overlay, or answer questions about revdiff usage, configuration, themes, and keybindings. Opens revdiff in agterm/tmux/zellij/herdr/kitty/wezterm/cmux/ghostty/iterm2/emacs-vterm, captures annotations, and addresses them. Works in git, hg, and jj repos…
fix-pr
One-verb pipeline for the operator's highest-frequency manual loop: fetch a PR's unresolved reviewer feedback (inline review comments, review-summary bodies, and issue-level conversation comments) and failing CI checks, triage each issue via parallel read-only probes, fix the validated items in an isolated managed…
tour
Tour is a local code-walkthrough CLI for AI agents. After finishing a task, the agent leaves line-anchored comments on a pinned git diff (a guided traversal) that a human steps through in a TUI or webapp. Activates when the user asks to "review this branch", "review this PR", "walk me through this diff", "leave…
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.