agentic-kit: Skill for Claude Code

.agents/skills/ak-release/SKILL.md

ak-release is a skill for Claude Code, Codex from pacphi/agentic-kit. It costs 85 tokens per session (1,674 once invoked), scanned A, original, MIT.

A release workflow for publishing an agentic-kit version to npm and creating its GitHub Release. It covers version selection, release tags, checks, publishing, and closing tracking work.

In plain words
What is it for?
Use it to choose a semantic version, update package metadata, create a release commit and annotated tag, monitor publishing, verify npm and GitHub, and close related tracking items.
Why use it?
A release can publish code that is not merged, use the wrong version or tag, or expose an irreversible package change. This workflow adds checks and separate approval points before outward actions.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents).

This is pacphi/agentic-kit's own configuration. It tells Claude Code and Codex how to work on agentic-kit itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything agentic-kit configures →

Reuse

Borrowing it

Nothing to install: this file belongs to pacphi/agentic-kit. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/pacphi/agentic-kit/main/.agents/skills/ak-release/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/pacphi/agentic-kit

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ak-release

README.md
[![agentmods](https://agentmods.dev/badge/skills/pacphi/agentic-kit/ak-release/github.svg)](https://agentmods.dev/skills/pacphi/agentic-kit/ak-release)
Your own site
<a href="https://agentmods.dev/skills/pacphi/agentic-kit/ak-release"><img src="https://agentmods.dev/badge/skills/pacphi/agentic-kit/ak-release/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for ak-release

Your own site · 80×15
<a href="https://agentmods.dev/skills/pacphi/agentic-kit/ak-release"><img src="https://agentmods.dev/badge/skills/pacphi/agentic-kit/ak-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 85 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,674 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00085 $0.01674
Opus 5.5 $0.00034 $0.00670
Sonnet 5.5 $0.00017 $0.00335
Haiku 4.5 $0.00009 $0.00167

Measured 23d ago against content hash 680cb30b3401, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

ak-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/ak-release/SKILL.md · 94 lines

How it starts

The opening of the file, as written. The whole thing — 94 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Release a version

A tag push publishes to npm and cannot be undone, so each outward step below needs its own yes.

When to use

The maintainer wants a new @pacphi/agentic-kit version published. The contents must already be merged to main. This skill does not merge feature PRs (use ak-ship).

Preflight

  1. Work in a checkout you own with git branch --show-current, git status --porcelain and git worktree list. Never switch branches in a checkout another session uses; if main is held elsewhere, use a worktree you create. Stop and report if the tree is dirty.
  2. git fetch origin and confirm the release base equals origin/main. Stop if it is behind, or if the contents the maintainer expects are not merged.
  3. Read the current version: node -p "require('./package.json').version". Read docs/maintainer.md sections 6 and 7 again if unsure. Section 7's checklist pushes main directly; the pull request path in step 4 is current practice.
  4. gh run list --workflow=release.yml --limit 3 and npm view @pacphi/agentic-kit dist-tags to see what shipped last.

Steps

  1. Choose the version with the maintainer, by SemVer and the bump rules in docs/maintainer.md section 6. Ask whether the next step is an alpha, a beta or an rc (-alpha.N and -rc.N go to next, -beta.N to the project-scoped beta line, a stable version to latest); never infer it. Confirm with node scripts/release-dist-tag.mjs <version> and show the result.
  2. Run the suite: node scripts/run-tests.mjs unit (the pnpm test script; never pnpm in a worktree). Stop if red.
  3. Bump version in package.json, the only place it lives. Check node bin/agentic-kit.mjs --version prints it.
  4. Release commit release: v<version>. Recent releases landed through a pull request because main requires one: push a release branch and open the PR only after a yes, then hand the merge to ak-ship (a release PR needs a fresh yes there). Pushing main directly needs its own yes that names this commit and this branch; a general "direct pushes are allowed" is not that yes. A rejected push is reported, never worked around. ak-ship's cleanup may remove the release branch's worktree: run step 5 onward from a checkout ak-ship is not removing.
  5. Verify the commit before tagging, and again right before the tag-push approval: git fetch origin, then git rev-parse HEAD must equal git rev-parse origin/main (or tag origin/main explicitly, as on the pull request path, where HEAD is the release branch). Read the version from the commit being tagged, not the working tree: git show origin/main:package.json | node -p "JSON.parse(require('fs').readFileSync(0, 'utf8')).version" must print <version>, and git log -1 --format=%s origin/main must be release: v<version> or release: v<version> (#<N>), where <N> is the release PR a squash merge appends. If any differs, stop and report. Never git checkout main in a worktree where it is held elsewhere.
  6. Create the annotated tag on the verified commit, matching exactly: git tag -a v<version> -m "v<version>" origin/main. Show git show v<version> --stat and the dist-tag.
  7. Tag push, separate approval: name the tag, the commit and the dist-tag, repeat the step 5 checks, then run git push origin v<version> only after that yes. This starts the publish (release.yml runs pnpm publish; you never publish).
  8. Watch the publish, separate approval (cheap to give, it only reads): gh run list --workflow=release.yml --limit 5 --json databaseId,headBranch,event,status. Pick the run whose headBranch is v<version> and event is push, not an earlier run or a workflow_dispatch dry run; if none appears yet, wait and list again. Then gh run watch <run-id> --exit-status. A failure on the tag-version guard or tests published nothing; report it and the fix options in docs/maintainer.md section 7, and do not move or delete the tag without a yes for that exact action.
  9. npm check, separate approval (also read-only and cheap): npm view @pacphi/agentic-kit dist-tags and npm view @pacphi/agentic-kit@<version> version dist.tarball. Allow about eight minutes after the workflow reports success; a 404 on the tarball inside that window is registry lag, not a failed publish, so wait and re-check.
  10. gh release view v<version> --json tagName,isPrerelease (the workflow creates it; do not run gh release create). Prereleases must show isPrerelease true.
  11. Close the release epic and its items in the GitHub Project after a yes per target, with gh issue close <N> --comment "Released in v<version>"; list the numbers first.
  12. Remind the maintainer that the global ak is the published npm copy, not the repo: run npm i -g @pacphi/agentic-kit@<dist-tag>, then ak sync. Do not run it unasked.

Read the full file on GitHub · 94 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 23d ago First seen · 94 lines · 85 tokens per session scan A 680cb30b3401

Subscribe to this mod's changes

ak-release is a skill published in the GitHub repository pacphi/agentic-kit (61 stars, last pushed yesterday), licensed MIT. It adds 85 tokens to every session and 1,674 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-05.

Related

Other skills, from other repositories

draft-release-notes

Author the committed release-notes file for a Prisma 8 release (stable or 8.0.0-rc.N) by enumerating the merged PRs since the previous release v tag (stable or -rc.N), resolving opaque TML-NNNN: titles via Linear context (never copied verbatim), triaging public-worthiness, and writing categorized notes — breaking…

prisma/orm · 174 tokens

publish-npm-version

Cuts the next release of Prisma 8: bumps the root package.json version (on the v8 RC line: 8.0.0-rc.N → rc.N+1), propagates it to every workspace package, and opens a PR titled "chore(release): bump to ". When the maintainer merges the PR, the Publish to npm workflow runs automatically and ships the new version to npm…

prisma/orm · 182 tokens

version-bump

Automated semantic versioning and release workflow for Claude Code plugins. Handles version increments across package.json, marketplace.json, plugin.json manifests, build verification, git tagging, GitHub releases, and changelog generation. npm publishing is done by the tag-triggered GitHub Actions workflow through…

thedotmack/claude-mem · 64 tokens

batch

Research and plan a large-scale change, then execute it in parallel across 5–30 isolated worktree agents that each open a PR.

asgeirtj/system_prompts_leaks · 30 tokens

github

GitHub via gh CLI: PRs, issues, reviews, repos, auth.

NousResearch/hermes-agent · 19 tokens

changelog

Auto-generate a changelog from git commits and sprint data. Internal and player-facing versions.

Donchitos/Claude-Code-Game-Studios · 22 tokens