Borrowing it
Nothing to install: this file belongs to patrickjaja/claude-desktop-extra. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/patrickjaja/claude-desktop-extra/master/.claude/skills/deploy/SKILL.mdgit clone --depth 1 https://github.com/patrickjaja/claude-desktop-extraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/patrickjaja/claude-desktop-extra/deploy)<a href="https://agentmods.dev/skills/patrickjaja/claude-desktop-extra/deploy"><img src="https://agentmods.dev/badge/skills/patrickjaja/claude-desktop-extra/deploy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/patrickjaja/claude-desktop-extra/deploy"><img src="https://agentmods.dev/badge/skills/patrickjaja/claude-desktop-extra/deploy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.01115 |
| Opus 5.5 | $0.00022 | $0.00446 |
| Sonnet 5.5 | $0.00011 | $0.00223 |
| Haiku 4.5 | $0.00005 | $0.00112 |
Grade A, and why
deploy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 49 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Deploy - trigger Build & Release
Args: $ARGUMENTS (force / no-force override the auto-decision; empty = decide automatically).
Context
- Repo:
patrickjaja/claude-desktop-extra· Workflow:build-and-release.yml· default branch:master. - Current branch: !
git branch --show-current - Tracked upstream version: !
cat .upstream-version 2>/dev/null - Last release: !
gh -R patrickjaja/claude-desktop-extra release list --limit 1 2>/dev/null || echo "(gh not ready)" - Recent runs: !
gh -R patrickjaja/claude-desktop-extra run list --workflow=build-and-release.yml --limit 3 2>/dev/null || echo "(gh not ready)"
Versioning semantics (format: {upstream}-{pkgrel})
- New upstream version (
.upstream-versionwas bumped by/update): pkgrel resets to 1 automatically. This is the plain non-force run. - Re-release at the same upstream version: pkgrel auto-increments (CI counts existing releases). This needs
force_rebuild=true. It does not matter whether the change was a patch (new patched payload) or packaging-only (launcher, .desktop, packaging scripts) - both simply bump pkgrel; the kind of change belongs in the CHANGELOG entry and the release notes, not in the version. - pkgrel is never chosen by hand. CI computes it (counts existing releases) and, after publishing, stamps it into
packaging/nix/package.nixalongsideversionand the tarballhash- Nix consumers fetch from the release's own immutable tag (v<upstream>for pkgrel 1,v<upstream>-<pkgrel>otherwise; assets are never overwritten, issue #214). The pkgrel/hash literals in package.nix are CI-managed; never edit them manually.
Steps
- Resolve the last release tag (from the Last release context above;
v<upstream>orv<upstream>-<pkgrel>). - Decide FORCE (skip if
$ARGUMENTSsaysforceorno-force- explicit wins):- If
.upstream-versionon HEAD differs from the upstream part of the last release tag → FORCE=false (new-upstream release, pkgrel resets to 1). - Else look at what changed:
git fetch --tags originthengit diff --name-only <last-tag>..origin/master. Classify:- any
patches/orjs/file → payload update → FORCE=true - else any
scripts/,packaging/,flake.nix,.github/workflows/file → packaging-only update → FORCE=true - else (docs/site/skills/CHANGELOG/baseline only) → STOP: nothing shippable changed; tell the user a release would publish identical packages and ask if they really want
/deploy force.
- any
- If
- Print a one-line plan including the classification, e.g. "Triggering build-and-release.yml on
master(force_rebuild=true - packaging-only update, pkgrel will bump)". Mention the classification so the CHANGELOG/release notes wording can say "payload update" vs "packaging-only". - Fire it (no interactive confirmation - the user already typed /deploy):
gh -R patrickjaja/claude-desktop-extra workflow run build-and-release.yml -f force_rebuild=<FORCE> - Wait ~3s, then resolve the run and report its URL:
Report the run URL and status. Offer: "Watch withgh -R patrickjaja/claude-desktop-extra run list --workflow=build-and-release.yml --limit 1 \ --json databaseId,url,status,event,createdAtgh -R patrickjaja/claude-desktop-extra run watch <id>".
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed 1b40e25fb322
- 2mo ago First seen · 49 lines · 54 tokens per session scan A e63179a991d5
deploy is a skill published in the GitHub repository patrickjaja/claude-desktop-extra (726 stars, last pushed yesterday), licensed MIT. It adds 54 tokens to every session and 1,115 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
deploy compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| deploypatrickjaja/claude-desktop-extra | Skill | 726 | yesterday | MIT | A | 54 | Claude Code |
| changelog-generatorcomposio-community/awesome-claude-plugins | Skill | 2.0k | yesterday | none | A | 48 | Claude Code |
| version-bumpthedotmack/claude-mem | Skill | 114k | yesterday | Apache-2.0 | A | 64 | Claude Code |
| batchasgeirtj/system_prompts_leaks | Skill | 71k | 2d ago | CC0-1.0 | A | 30 | Claude Code |
| githubNousResearch/hermes-agent | Skill | 261k | yesterday | MIT | A | 19 | Claude Code, Codex |
| releasethedotmack/claude-mem | Skill | 114k | yesterday | Apache-2.0 | A | 13 | Claude Code |
| changelogDonchitos/Claude-Code-Game-Studios | Skill | 36k | 18d ago | MIT | A | 22 | Claude Code |