Borrowing it
Nothing to install: this file belongs to PixelPaw-Labs/codex-trace. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/PixelPaw-Labs/codex-trace/main/.claude/skills/cut-release/SKILL.mdgit clone --depth 1 https://github.com/PixelPaw-Labs/codex-traceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pixelpaw-labs/codex-trace/cut-release)<a href="https://agentmods.dev/skills/pixelpaw-labs/codex-trace/cut-release"><img src="https://agentmods.dev/badge/skills/pixelpaw-labs/codex-trace/cut-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pixelpaw-labs/codex-trace/cut-release"><img src="https://agentmods.dev/badge/skills/pixelpaw-labs/codex-trace/cut-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00210 | $0.01415 |
| Opus 5.5 | $0.00084 | $0.00566 |
| Sonnet 5.5 | $0.00042 | $0.00283 |
| Haiku 4.5 | $0.00021 | $0.00142 |
Grade A, and why
cut-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
98% identical to cut-release — 10 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cut a Release — codex-trace
Turns "we should release this" into a tagged, pushed, pipeline-triggered, publicly published release with a curated CHANGELOG, in a way that survives the project's strict pre-commit hook and stays honest about what's actually shipping.
The skill is project-local because the steps depend on this repo's specific shape (three
version files, two lockfiles, GH Actions release on v* tag, the test-reflection
pre-commit hook).
Operating mode
The skill is fully automated end-to-end and fully synchronous. It never calls
AskUserQuestion, never waits for "yes", never branches on user preference, and
never runs any command in the background. Every Bash invocation runs in the
foreground so the session holds continuously from Phase 1 through Phase 9 — no
run_in_background: true, no trailing &, no nohup, no disown. This includes
long-running steps like gh run watch in Phase 7; set the Bash timeout parameter to
match the expected duration (e.g. 1800000 ms for the release pipeline) rather than
detaching.
Defaults are deterministic:
- Scope — always linear: every commit since
git describe --tags --abbrev=0ships. - Bump tier — highest conventional-commit tier in the subset (see
${CLAUDE_SKILL_DIR}/references/conventional-commits.md).BREAKING CHANGE:or!:produces a minor bump while the version is0.X.Y(pre-1.0 caveat) and a major bump otherwise; the skill never silently promotes to 1.0.0. - CHANGELOG — every Added/Fixed bullet is written from commit subjects + diff reads;
chore:/docs:/test:/ci:are always skipped. - Push order — tag first, then main (so CI sees the tag immediately; main catches up after).
The skill aborts (loudly) only on hard preconditions that would corrupt the release:
- Duplicate version — the proposed
vX.Y.Ztag already exists onorigin. Abort withError: vX.Y.Z already exists on origin (commit <sha>). Refusing to release the same version twice.The user must delete the remote tag intentionally if they want a re-release, or bump again. - Dirty working tree — uncommitted changes the skill didn't create. Abort with a list of dirty files.
npm run checkfails — abort and surface the failure verbatim.
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/changelog-template.md 3.6 KB
- references/conventional-commits.md 3.0 KB
- references/project-shape.md 4.2 KB
- steps/phase1-inspect-and-scope.md 2.7 KB
- steps/phase2-build-release-branch.md 1.2 KB
- steps/phase3-bump-versions.md 1.7 KB
- steps/phase4-changelog.md 2.6 KB
- steps/phase5-verify-commit-tag.md 3.1 KB
- steps/phase6-push-tag.md 1.4 KB
- steps/phase7-publish-github-release.md 3.8 KB
- steps/phase8-back-to-main.md 2.1 KB
- steps/phase9-cleanup.md 1.2 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 124 lines · 210 tokens per session scan A e8dde62c52aa
cut-release is a skill published in the GitHub repository PixelPaw-Labs/codex-trace (116 stars, last pushed 6d ago), licensed MIT. It adds 210 tokens to every session and 1,415 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 98% identical to cut-release, differing in 10 lines, and is treated as a copy.
Other skills, from other repositories
app-release
Use when the user asks to release a new version, ship a build, or publish a Skill Zoo release. Also use when a tag push results in Homebrew 404 errors or missing artifact failures.
npm-release
Use when publishing or preparing to publish an npm package from this repository, especially the Skill Zoo CLI package under packages/cli. Also use when npm publish fails because of duplicate versions, npm authentication, browser authentication, dist-tag propagation, tarball contents, bin entry issues, or…
github
Drive GitHub via the official gh CLI — repos, issues, pull requests, releases, gists, Actions runs, and raw REST through gh api. Use when the user asks to inspect or manage GitHub.
mina-ralph-loop-bootstrap-nextjs
Bootstrap or extend a new or early-stage Next.js App Router + TypeScript repository around a Ralph-style task-promotion loop. Use when Codex needs to ask the founder product and architecture questions, generate or update the repo-local markdown knowledge base, create the initial scaffold or the next feature wave…
release-safety
Release safety rules. INVOKE WHEN: yarn release, npm publish, release canary, release packages, publishing, skip checks, skip tests. NEVER skip checks or tests without explicit permission.
git-workflow
Guided git workflows: prepare PRs, clean up branches, resolve merge conflicts, handle monorepo tags, squash-and-merge patterns. Use when asked to prepare a PR, clean branches, resolve conflicts, or tag a release.