grafana-mcp: Skill for Claude Code

.claude/skills/npm-release/SKILL.md

npm-release is a skill for Claude Code from ninanung/grafana-mcp. It costs 105 tokens per session (1,529 once invoked), scanned A, original, MIT.

A release procedure for publishing an npm package, a reusable JavaScript or TypeScript package. It uses GitHub Actions, an automated workflow service, to build and publish after a version tag is pushed.

In plain words
What is it for?
Use it to choose a patch, minor, or major version, run release checks, update documentation, create a tag, and publish through GitHub Actions.
Why use it?
It prevents unsafe releases by requiring checks for the branch, working tree, dependencies, build, lint, security audit, and documentation before publishing.

Skill for Claude Code

Written for Claude Code: installed under .claude/. Also seen: mentions CLAUDE.md.

This is ninanung/grafana-mcp's own configuration. It tells Claude Code how to work on grafana-mcp itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything grafana-mcp configures →

Reuse

Borrowing it

Nothing to install: this file belongs to ninanung/grafana-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/ninanung/grafana-mcp/main/.claude/skills/npm-release/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/ninanung/grafana-mcp

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for npm-release

README.md
[![agentmods](https://agentmods.dev/badge/skills/ninanung/grafana-mcp/npm-release/github.svg)](https://agentmods.dev/skills/ninanung/grafana-mcp/npm-release)
Your own site
<a href="https://agentmods.dev/skills/ninanung/grafana-mcp/npm-release"><img src="https://agentmods.dev/badge/skills/ninanung/grafana-mcp/npm-release/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for npm-release

Your own site · 80×15
<a href="https://agentmods.dev/skills/ninanung/grafana-mcp/npm-release"><img src="https://agentmods.dev/badge/skills/ninanung/grafana-mcp/npm-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 105 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,529 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00105 $0.01529
Opus 5.5 $0.00042 $0.00612
Sonnet 5.5 $0.00021 $0.00306
Haiku 4.5 $0.00011 $0.00153

Measured 10d ago against content hash b7dd51c5749c, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

npm-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/npm-release/SKILL.md · 81 lines

How it starts

The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.

npm 배포를 수행한다. 아래 절차를 순서대로 실행하고, 단계를 임의로 생략하지 않는다. 로컬에서 npm publish 를 직접 실행하지 않는다 — 배포 주체는 GitHub Actions 다 (.claude/rules/npm-publish-rule.md).

0. 인자

  • 버전 종류: patch(기본) / minor / major, 또는 명시 버전(예: 0.2.0)
  • 사용자가 안 주면 변경 내용으로 판단한다: 버그픽스·문구·env 추가·의존성 갱신 → patch, 새 도구·인자·출력 형태 변경 → minor, 기존 소비자가 깨지는 변경 → major

1. 사전 점검 (하나라도 실패하면 멈추고 사용자에게 알린다)

node -v                       # package.json engines(>=22) 를 만족해야 함
git status --short            # 비어 있어야 함 (미커밋 변경 금지)
git branch --show-current     # main 이어야 함. 아니면 먼저 main 에 병합
git fetch origin && git log origin/main..main --oneline   # 미푸시 커밋은 있어도 됨 (같이 push 됨)
npm ci --dry-run 2>&1 | grep -i "error"   # 락파일 동기화 확인, 출력 없어야 함
npm run build && npm run lint
npm audit --omit=dev          # 런타임 의존성 취약점. 있으면 사용자에게 알리고 진행 여부 확인
  • README 릴리즈 직전 재확인: CLAUDE.md 의 "README 동기화" 5단계를 수행한다.
    1. git describe --tags --abbrev=0 로 직전 릴리즈 태그를 찾는다.
    2. git diff <직전 태그>..HEAD 로 바뀐 것을 항목으로 뽑는다.
    3. README.md 와 README_kr.md 를 처음부터 끝까지 line by line 대조한다.
    4. 결과(수정한 줄, 또는 대조한 범위와 "반영할 것 없음")를 보고에 남긴다.
  • package.json 의 repository.url 이 git+https://github.com/ninanung/grafana-mcp.git 인지 확인한다 (Trusted Publishing·provenance 매칭 조건).

2. 릴리스 노트 준비

git log <직전 태그>..HEAD --oneline 으로 변경을 모아 한 줄 요약을 만든다. 사용자에게 보여 주고 버전 종류가 맞는지 짧게 확인한다 (사용자가 이미 버전을 지정했으면 생략).

3. 버전 올리고 태그 push

npm version <patch|minor|major|x.y.z> -m "%s"   # package.json·lockfile 갱신 + 커밋("0.1.4") + v0.1.4 태그
git push --follow-tags origin main
  • 커밋 메시지는 버전 숫자만 쓴다 (이력의 0.1.2, 0.1.3 과 같은 형식).
  • npm version 이 만든 태그(v0.1.4 형식)가 워크플로 트리거다.
  • 태그를 손으로 만들 때도 v 접두를 붙인다. git tag v<버전> 으로 만든 태그는 --follow-tags 로 올라가지 않으므로 git push origin v<버전> 으로 따로 push 한다.

4. 워크플로 완료 대기 및 검증

gh run list --workflow=publish.yml --limit 1 --json databaseId,headBranch,status   # run id 확보
gh run watch <run-id> --exit-status --interval 10
npm view @seungje.jun/grafana-mcp@<버전> version dist.attestations --prefer-online   # 새 버전 + provenance 확인

Read the full file on GitHub · 81 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 81 lines · 105 tokens per session scan A b7dd51c5749c

Subscribe to this mod's changes

npm-release is a skill published in the GitHub repository ninanung/grafana-mcp (0 stars, last pushed 11d ago), licensed MIT. It adds 105 tokens to every session and 1,529 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-27.

Related

npm-release compared with skills from other repositories

npm-release next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
npm-releaseninanung/grafana-mcpSkill011d agoMITA105Claude Code
github-release-managementruvnet/RuViewSkill103kyesterdayMITA27Claude Code
agent-github-modesruvnet/rufloSkill81kyesterdayMITA21Claude Code
xberg-releasexberg-io/xbergSkill9.5kyesterdayMITA16Claude Code, Codex
factory-shipBuilderIO/skillsSkill4.6k4d agoMITA28Claude Code
releaseprcompozy/compozySkill2.8kyesterdayMITA53Claude Code, Codex
gitlab-devopsautomateyournetwork/netclawSkill715yesterdayApache-2.0A67Claude Code, Codex