Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/openshift-eng/ai-helpersnpx agentmods add skills/openshift-eng/ai-helpers/analyze-release-go-versionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/openshift-eng/ai-helpers/analyze-release-go-versions)<a href="https://agentmods.dev/skills/openshift-eng/ai-helpers/analyze-release-go-versions"><img src="https://agentmods.dev/badge/skills/openshift-eng/ai-helpers/analyze-release-go-versions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/openshift-eng/ai-helpers/analyze-release-go-versions"><img src="https://agentmods.dev/badge/skills/openshift-eng/ai-helpers/analyze-release-go-versions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.00806 |
| Opus 5.5 | $0.00019 | $0.00322 |
| Sonnet 5.5 | $0.00009 | $0.00161 |
| Haiku 4.5 | $0.00005 | $0.00081 |
Grade A, and why
analyze-release-go-versions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Analyze release Go versions
Use only the scripts below to collect release data. Do not independently inspect registries, GitHub, repositories, Dockerfiles, go.mod files, or build configs. Your job is to interpret and filter script output for the user's question. If the user supplies output from these scripts, analyze that output directly.
Run from the repository root, replacing placeholders with the user's values:
python3 plugins/golang/scripts/release_go_builder_versions.py <release-image> --correlate-builder --build-root
python3 plugins/golang/scripts/release_go_builder_versions.py <release-image> --correlate-builder
python3 plugins/golang/scripts/release_go_builder_versions.py <release-image> --build-root
python3 plugins/golang/scripts/release_go_module_versions.py <release-image> <module>
python3 plugins/golang/scripts/release_go_module_versions.py <release-image> --go-version
<module> is the full Go module path the user is asking about (e.g. google.golang.org/protobuf, golang.org/x/net, k8s.io/client-go — any valid module works).
- Run only the needed script and mode.
--correlate-builderscans Dockerfiles or Containerfiles selected by release image build configs, including distinct OKD variants. Omit it only when the user wants all matching files in each source repository.--build-rootreports Go versions from each component's.ci-operator.yamlbuild root image tag (e.g.rhel-9-release-golang-1.26-openshift-5.0→1.26). This shows the CI build environment Go version, which may differ from the Dockerfile builder.- Combine both flags (
--correlate-builder --build-root) when the user asks about both Dockerfile builders and CI build roots. This avoids a redundant pass over the release — both lookups share the same source-repo resolution. The combined output appendsbuild root tagandbuild root go versioncolumns to each Dockerfile row. Prefer the combined form when both kinds of evidence are needed. - Used alone,
--build-rootproduces a compact 4-column output (component, repository, build root tag, go version) without Dockerfile scanning. - The builder script explicitly maps the two installer artifact components to build-data configs without
payload_name. Fornutanix-cluster-api-controllers, it scansopenshift/Dockerfile.openshiftin the source repository at the release-recorded ref when no build-data config matches; identify that row as source-repository evidence. - For a requested module, use its exact Go module path (e.g.
google.golang.org/grpc). Use--go-versiononly when the user asks aboutgodirectives ingo.mod. Run multiple scripts when the question needs both kinds of evidence. - Filter by component, repository, version, or variant as requested. Treat every returned row as separate evidence; the module script can return multiple rows per component and does not identify the
go.modpath in its output. - Preserve
(none), unknown values, and lookup errors as unknown or unavailable. Report module replacements as declared in script output, including local paths and fork modules. A builder tag such asgolang-1.26identifies the declared builder image version; agodirective or module declaration does not prove which compiler built the final image or which module version its binary contains. - Report the filtered results and any material coverage gaps. Do not fill gaps by fetching data yourself.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago First seen · 34 lines · 47 tokens per session scan A 96497dd02342
analyze-release-go-versions is a skill published in the GitHub repository openshift-eng/ai-helpers (121 stars, last pushed today), licensed Apache-2.0. It adds 47 tokens to every session and 806 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-07.
Other skills, from other repositories
golang-testing
Go testing best practices including table-driven tests, test helpers, benchmarking, race detection, coverage analysis, and integration testing patterns. Use when writing or improving Go tests.
golang-patterns
Go-specific design patterns and best practices including functional options, small interfaces, dependency injection, concurrency patterns, error handling, and package organization. Use when working with Go code to apply idiomatic Go patterns.
ax-go-agent-optimize
Use when writing Go code with github.com/ax-llm/ax/packages/go for agent optimization, verified agent-playbook evolution, evaluators, judges, optimizer artifacts, BootstrapFewShot, and GEPA.
golang-testing
Production-ready Golang tests — table-driven tests, testify suites and mocks, parallel tests, fuzzing, fixtures, goroutine leak detection with goleak, snapshot testing, code coverage, integration tests, idiomatic test naming. Use when writing or reviewing Go tests, choosing a testing approach, setting up Go test CI…
golang-samber-oops
Structured error handling in Golang with samber/oops — error builders, stack traces, error codes, error context, error wrapping, error attributes, user-facing vs developer messages, panic recovery, and logger integration. Apply when using or adopting samber/oops, or when the codebase already imports…
golang-uber-fx
Golang application framework using uber-go/fx — fx.New, fx.Provide, fx.Invoke, fx.Module, fx.Lifecycle hooks, fx.Annotate (name/group/As), fx.Decorate, fx.Supply, fx.Replace, fx.WithLogger, and signal-aware Run(). Apply when using or adopting uber-go/fx, when the codebase imports go.uber.org/fx, or when wiring…