Borrowing it
Nothing to install: this file belongs to Peiiii/nextclaw. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Peiiii/nextclaw/master/.agents/skills/nextclaw-npm-release/SKILL.mdgit clone --depth 1 https://github.com/Peiiii/nextclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/peiiii/nextclaw/nextclaw-npm-release)<a href="https://agentmods.dev/skills/peiiii/nextclaw/nextclaw-npm-release"><img src="https://agentmods.dev/badge/skills/peiiii/nextclaw/nextclaw-npm-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/peiiii/nextclaw/nextclaw-npm-release"><img src="https://agentmods.dev/badge/skills/peiiii/nextclaw/nextclaw-npm-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.01946 |
| Opus 5 | $0.00032 | $0.00973 |
| Sonnet 5 | $0.00013 | $0.00389 |
| Haiku 4.5 | $0.00006 | $0.00195 |
Grade A, and why
nextclaw-npm-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NextClaw NPM Release
阶段路由
- 版本范围、changeset、依赖闭包、registry 发布：读取 Package 发布。
- beta/stable runtime bundle、manifest、Pages：读取 Runtime channel。
- 验证真实
nextclaw@beta/latest安装与 update：读取 Published install。 - 隔离 worktree、release branch 与 master 回流：读取 分支闭合。
- 用户要求统一 beta 发布闭环：读取 Beta 发布。
- 已提交发布范围必须与当前 WIP 隔离：读取 隔离 Worktree。
一次只读取当前阶段。Desktop installer/DMG 由 desktop release skill 拥有。
永久合同
- 渐进交付、最早结果优先：
target=npm|product在 package 身份、产物和授权成立后立即 dispatch，固定按NPM_READY -> Runtime/update READY -> CONTENT_READY交付；release notes、官网、配图、博客和 X 不得阻塞首次 NPM。Agent 若先进入这些非阻塞分支，立即停止并返回最早可交付门。 - 发布后提交：release 与 reconcile 完成后，把本次已验证的流程、Skill 和记录改动精确 commit、push，不留临时 worktree。未获“合入主干”授权时只推当前隔离分支并报告；无关 WIP 排除。
- 正式发布同时交付产物与自动化闭环；用结构化时序/依赖图找 critical path、错误等待和无效串行/重复，超预算须修 owner、补合同并沿同 identity/recovery 验证。报告总/NPM_READY 耗时、瓶颈、优化和干预数；dispatch/准备/只读不计，非零时逐项写问题→修复。
- 使用仓库 release flow，不以包目录 raw
npm publish作为默认路径。 - 正式发布只 dispatch 一次 parent；Actions 独立闭合构建、发布、传播、真实升级验证、终态与 Git 回流，任何观察者在线都不是完成条件。
- 只调用 owning entry；下游 exact-stage 幂等恢复，禁止重发 identity。
- 验证拓扑按净收益选择：比较根因置信度、focused/failed-job 与全矩阵耗时、重现稳定性和风险，选最低成本的有效层。平台适配、spawn、临时清理、artifact/recovery state 机在反复/高成本/不确定时须有可单模块或单 job 运行的入口和唯一失败映射；高置信度微修可直接 failed-only job。
- 全矩阵只作新 identity 的最终准入；stable recovery 只重跑未证明/失败/cancelled cell，同 tag 完整成功证据可复用。复用源由 Actions 用 tag 与 source ancestry 校验，禁止 AI 拼 matrix 命令或重发 NPM。
- dispatch 前审计队列并取消 SHA；工作流改动先过
actionlint并核对 reusable 权限。随后记录 run ID、target、head SHA；不得用 startup failure 作首轮校验。 - Actions 可等待 child；Agent 不参与状态迁移，只对 parent 有界等待并读最终 summary，禁止轮询、逐 step 监控或
gh run watch。成功 job 不读日志；异常只读失败附近。 nextclaw是已发布 workspace 依赖闭包和嵌入 UI/runtime 产物的产品包，不只看自身版本。- 发布包必须包含 launcher/app entries 和
resources/update-bundle-public.pem。 - NPM runtime manifest 使用
hostKind: npm-runtime-bundle，兼容 floor 来自packages/nextclaw/npm-runtime-compatibility.json，只有 launcher 合同破坏才提高。 - 发布授权按对象严格分层：NPM-only 不授权 runtime、desktop、文档站、官网或 X；常规 NextClaw stable 包含 NPM 与 runtime/product closure，但不包含 desktop；全平台发布完成常规 stable 后才转交 desktop owner。
target=npm|product可报CONTENT_READY|CONTENT_PENDING，内容不阻塞核心 NPM/Runtime；仅target=all首次 NPM 前验证结构化说明。stableminor/major由docs/releases/nextclaw-v<version>.release-review.json审查文档站、官网和 X，只影响内容状态，不回退核心完成点。- stable minor X 帖复用最近成功迭代已验证的
x-bird、Node/代理参数和回读命令；返回 ID 并回读作者、正文、媒体才闭合，阻断时标CONTENT_PENDING。
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · -5 lines 5b1394dc452c
- 10d ago First seen · 69 lines · 65 tokens per session scan A 654961237520
nextclaw-npm-release is a skill published in the GitHub repository Peiiii/nextclaw (256 stars, last pushed today), licensed MIT. It adds 65 tokens to every session and 1,946 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
graincrawl
Maintain, verify, and release graincrawl, the local-first Granola archive CLI, including SQLite archive behavior, read-only Granola source boundaries, Homebrew tap packaging, and crawlkit-powered TUI/snapshot surfaces.
crawlkit
Maintain and release the crawlkit Go library, preserving downstream compatibility for gitcrawl, slacrawl, discrawl, and notcrawl.
openclaw-github-dedupe
Investigate a cluster of GitHub issues and PRs, determine canonical candidates, post duplicate/related status, preserve contributor credit, and execute cleanup actions. Supports autonomous mode for provided-link-only closeout, merge/fix follow-through, changelog, and post-merge issue/PR cleanup.
openclaw-pr-batch-sweep
Select, review, repair, validate, and land batches of up to 20 low-risk OpenClaw contributor pull requests using Vincent's maintainer preferences and bounded sub-agent lanes. Use for "next 20", broad contributor PR sweeps, merge-candidate mining, or continued PR-batch work where drafts, maintainer work, trivial…
org-branch-cleanup
Audit and safely prune stale branches across a GitHub organization with immutable snapshots, conservative merged-PR classification, live SHA/protection/open-PR revalidation, resumable deletion ledgers, and post-delete verification. Use when a maintainer asks to clean up old, dead, merged, bot-created, or abandoned…
github-airplane-mode
Inspect or switch the local Git and GitHub download guard using an already-installed compatible low-data command. Use for airplane mode, flight or metered connections, returning online, or requests to enable, disable, or automatically select low-data protection on this machine.