Borrowing it
Nothing to install: this file belongs to nikicat/mcp-wallet-signer. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/nikicat/mcp-wallet-signer/master/.claude/skills/publish/SKILL.mdgit clone --depth 1 https://github.com/nikicat/mcp-wallet-signerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nikicat/mcp-wallet-signer/publish)<a href="https://agentmods.dev/skills/nikicat/mcp-wallet-signer/publish"><img src="https://agentmods.dev/badge/skills/nikicat/mcp-wallet-signer/publish/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nikicat/mcp-wallet-signer/publish"><img src="https://agentmods.dev/badge/skills/nikicat/mcp-wallet-signer/publish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.02507 |
| Opus 5 | $0.00014 | $0.01254 |
| Sonnet 5 | $0.00005 | $0.00501 |
| Haiku 4.5 | $0.00003 | $0.00251 |
Grade C, and why
publish scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -s "https://jsr.io/<jsr-name>/meta.json" | python3 -c "import sys, json; print(list(json.load(sys.stdin).get('versions', {}).keys()))" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://jsr.io/<jsr-name>/meta.json" | python3 -c "import sys, json; print(list(json.load(sys.stdin).get('versions', {}).keys()))" How it starts
The opening of the file, as written. The whole thing — 158 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Publish a package from this monorepo via GitHub release. The publish workflow always publishes to all supported registries for the package (see table below) — there is no way to select individual registries.
Arguments are optional and positional — any can be omitted:
package:mcp-wallet-signer,browser-evm-signer, orbrowser-tron-signerbump:patch,minor, ormajor
Note: wallet-signer-core is an internal-only monorepo package — it's inlined into both chain packages by dnt, so no consumer would install it directly from npm. Don't publish it.
Inferring missing arguments
When arguments are omitted, infer them from context:
- Package: Run
git diff HEAD~3 --stat -- packages/to find which package(s) changed recently. If exactly one, use it. If ambiguous, ask the user. - Bump: Recommend based on the diff (see step 2 below). Ask for confirmation.
Package details
| Package | Dir | Version field in deno.jsonc |
npm name | JSR name | Supported registries |
|---|---|---|---|---|---|
| mcp-wallet-signer | packages/mcp-wallet-signer |
npm.version |
mcp-wallet-signer |
— | npm |
| browser-evm-signer | packages/browser-evm-signer |
top-level version |
browser-evm-signer |
@nikicat/browser-evm-signer |
npm, jsr |
| browser-tron-signer | packages/browser-tron-signer |
top-level version |
browser-tron-signer |
@nikicat/browser-tron-signer |
npm, jsr |
First publish of a new package
New npm packages need a one-time manual bootstrap before the GitHub-Actions OIDC flow works. For the very first publish of a new package:
- Build locally:
cd packages/<dir> && deno task build:npm - From the user's shell:
cd packages/<dir>/npm && npm login && npm publish --provenance --access public(interactive — user runs) - JSR (if applicable):
cd packages/<dir> && deno publish --allow-dirty - Tag the commit and push, but skip creating a GitHub release for this initial version — the publish workflow would otherwise fire on
release: createdand fail because the version is already on the registry. - Authorize the GitHub workflow on each registry — do this immediately, even though the next release may be weeks away:
- npm Trusted Publisher (https://www.npmjs.com/package/<npm-name>/access → "Trusted Publishers"): add provider
GitHub Actions, ownernikicat, repomcp-wallet-signer, workflowpublish.yml, environment blank. Without this, the workflow'snpm publish --provenancefails withENEEDAUTH—secrets.NPM_TOKENis unset in this repo on purpose; the workflow relies entirely on OIDC. - JSR linked repo (https://jsr.io/<jsr-name>/settings → "GitHub repository"): set to
nikicat/mcp-wallet-signer. Without this,deno publish --allow-dirtyfails withactorNotAuthorized. Authorization is per-package — granting it for one package does not carry over to a sibling under the same scope.
- npm Trusted Publisher (https://www.npmjs.com/package/<npm-name>/access → "Trusted Publishers"): add provider
- The next version bump (≥ 0.x.y+1) goes through the normal workflow flow below.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 158 lines · 27 tokens per session scan C 6cae12a6746d
publish is a skill published in the GitHub repository nikicat/mcp-wallet-signer (3 stars, last pushed 1mo ago), licensed MIT. It adds 27 tokens to every session and 2,507 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
git-workflow
Git branch management, commit conventions, and PR creation workflow. Use for all tasks that require code changes, regardless of language or scope.
fix-pr-review
Address PR review comments by selecting appropriate skills based on modified files. Use when fixing review feedback on pull requests.
db-migration
Database schema and migration workflow. Use when modifying database schemas in tools/atlas/ or SQLC queries in tools/sqlc/.
github-issue-creation
Create GitHub issues with proper task classification. Classification determines which Skills will be used when working on the issue.
doc-changelog-writer
Generate CHANGELOG.md entries from git commits.
git-wrapup
Land working-tree changes as logical commits — the work grouped by concern, topped by a release commit (version bump, changelog, regenerated artifacts) and an annotated tag. Verify, commit, tag. Stops at "committed and tagged locally" — no push, no publish. The release-and-publish skill picks up from here. Distilled…