Borrowing it
Nothing to install: this file belongs to PinMeTo/pinmeto-location-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/PinMeTo/pinmeto-location-mcp/main/.claude/skills/release/SKILL.mdgit clone --depth 1 https://github.com/PinMeTo/pinmeto-location-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pinmeto/pinmeto-location-mcp/release)<a href="https://agentmods.dev/skills/pinmeto/pinmeto-location-mcp/release"><img src="https://agentmods.dev/badge/skills/pinmeto/pinmeto-location-mcp/release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pinmeto/pinmeto-location-mcp/release"><img src="https://agentmods.dev/badge/skills/pinmeto/pinmeto-location-mcp/release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 13 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 19 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.00431 |
| Opus 5 | $0.00021 | $0.00216 |
| Sonnet 5 | $0.00008 | $0.00086 |
| Haiku 4.5 | $0.00004 | $0.00043 |
Grade A, and why
release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Release Workflow
This project uses Changesets for version management and changelog generation.
Adding Changes (Contributors)
npx changeset add # Add a changeset for your changes
# Select: major/minor/patch
# Write: summary (appears in CHANGELOG)
git add .changeset/ && git commit -m "docs: add changeset"
⚠️ REQUIRED: Every PR must include a changeset. CI will reject PRs without one. For changes that don't affect the published package (docs, internal tooling), add an empty changeset with npx changeset add --empty.
Version Guidelines
- patch: Bug fixes, documentation, internal changes
- minor: New features, enhancements (backwards compatible)
- major: Breaking changes (API changes, removed features)
Release Commands
npm run release:prepare # Preview pending changesets
npm run release:version # Bump version + update CHANGELOG + README badges
npm run release:draft # Test, build, pack, create draft GitHub release
npm run release:publish # Publish the draft release (or use GitHub UI)
npm run clean # Remove build directory
Release Flow (Maintainers)
- Run
npm run release:prepareto see pending changes - Run
npm run release:versionto apply version bump - Commit:
git add -A && git commit -m "chore: release vX.Y.Z" - Run
npm run release:draftto create draft release - Review draft on GitHub, then run
npm run release:publish - Push:
git push && git push --tags
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 45 lines · 42 tokens per session scan A 74aadd91a7ac
release is a skill published in the GitHub repository PinMeTo/pinmeto-location-mcp (15 stars, last pushed 5d ago), licensed MIT. It adds 42 tokens to every session and 431 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
release-changelog-harness
Chooses ecosystem-native release and changelog tooling (Changesets, Melos, release-plz) plus binary distribution (GitHub Release tarballs, install.sh) when the product is an executable. Use for release CI, install.sh, versioning, CHANGELOGs, shipping MCP/CLI without clone, or meta repos that only ship skills via npx…
polish-docs-meta
Finalize documentation and project metadata for a ship-ready release. Use after implementation is complete, tests pass, and devcheck is clean. Safe to run at any stage — each step checks current state and only acts on what still needs work.
release-and-publish
Ship a release end-to-end across every registry this project targets (npm, MCP Registry). Runs the final verification gate, pushes commits and tags, then publishes to each applicable destination. Assumes git wrapup (version bumps, changelog, commit, annotated tag) is already complete — this skill is the post-wrapup…
release-versioning
Discipline for release classification, version bumps, and changelogs, Conventional Commits classify the release range, SemVer computes the version from those commits, Keep a Changelog renders the result. Use when the user asks to cut a release, bump a version, write a changelog, decide if a change is a…
release-management
Tag a commit, publish a GitHub release, and read, correct or withdraw the tags and releases already there.
safe-deployment
Discipline for shipping changes reversibly, decouple deploy (code reaches production) from release (users see it) with feature flags, roll out progressively, and define the automated rollback trigger before shipping, not during the incident. Use when the user asks how to deploy a risky change, choose between…