Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/pixelpaw-labs/codex-trace/cut-releasenpx skills add PixelPaw-Labs/codex-trace --skill cut-releasegit clone --depth 1 https://github.com/PixelPaw-Labs/codex-traceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pixelpaw-labs/codex-trace/cut-release)<a href="https://agentmods.dev/skills/pixelpaw-labs/codex-trace/cut-release"><img src="https://agentmods.dev/badge/skills/pixelpaw-labs/codex-trace/cut-release.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00210 | $0.01415 |
| Opus 5 | $0.00105 | $0.00707 |
| Sonnet 5 | $0.00042 | $0.00283 |
| Haiku 4.5 | $0.00021 | $0.00142 |
Grade A, and why
cut-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
98% identical to cut-release — 10 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cut a Release — codex-trace
Turns "we should release this" into a tagged, pushed, pipeline-triggered, publicly published release with a curated CHANGELOG, in a way that survives the project's strict pre-commit hook and stays honest about what's actually shipping.
The skill is project-local because the steps depend on this repo's specific shape (three
version files, two lockfiles, GH Actions release on v* tag, the test-reflection
pre-commit hook).
Operating mode
The skill is fully automated end-to-end and fully synchronous. It never calls
AskUserQuestion, never waits for "yes", never branches on user preference, and
never runs any command in the background. Every Bash invocation runs in the
foreground so the session holds continuously from Phase 1 through Phase 9 — no
run_in_background: true, no trailing &, no nohup, no disown. This includes
long-running steps like gh run watch in Phase 7; set the Bash timeout parameter to
match the expected duration (e.g. 1800000 ms for the release pipeline) rather than
detaching.
Defaults are deterministic:
- Scope — always linear: every commit since
git describe --tags --abbrev=0ships. - Bump tier — highest conventional-commit tier in the subset (see
${CLAUDE_SKILL_DIR}/references/conventional-commits.md).BREAKING CHANGE:or!:produces a minor bump while the version is0.X.Y(pre-1.0 caveat) and a major bump otherwise; the skill never silently promotes to 1.0.0. - CHANGELOG — every Added/Fixed bullet is written from commit subjects + diff reads;
chore:/docs:/test:/ci:are always skipped. - Push order — tag first, then main (so CI sees the tag immediately; main catches up after).
The skill aborts (loudly) only on hard preconditions that would corrupt the release:
- Duplicate version — the proposed
vX.Y.Ztag already exists onorigin. Abort withError: vX.Y.Z already exists on origin (commit <sha>). Refusing to release the same version twice.The user must delete the remote tag intentionally if they want a re-release, or bump again. - Dirty working tree — uncommitted changes the skill didn't create. Abort with a list of dirty files.
npm run checkfails — abort and surface the failure verbatim.
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/changelog-template.md 3.6 KB
- references/conventional-commits.md 3.0 KB
- references/project-shape.md 4.2 KB
- steps/phase1-inspect-and-scope.md 2.7 KB
- steps/phase2-build-release-branch.md 1.2 KB
- steps/phase3-bump-versions.md 1.7 KB
- steps/phase4-changelog.md 2.6 KB
- steps/phase5-verify-commit-tag.md 3.1 KB
- steps/phase6-push-tag.md 1.4 KB
- steps/phase7-publish-github-release.md 3.6 KB
- steps/phase8-back-to-main.md 2.1 KB
- steps/phase9-cleanup.md 1.2 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 124 lines · 210 tokens per session scan A e8dde62c52aa
cut-release is a skill published in the GitHub repository PixelPaw-Labs/codex-trace (96 stars, last pushed 2d ago), licensed MIT. It adds 210 tokens to every session and 1,415 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. It is 98% identical to cut-release, differing in 10 lines, and is treated as a copy.
Other skills, from other repositories
tauri-updater
Use when adding software auto-update to a Tauri 2 desktop app, or when users ask about tauri-plugin-updater integration, app update checking, distinguishing installer vs portable builds for updates, or generating update manifests for GitHub Releases.
modly-cli
Use when an agent needs to call a running Modly desktop instance from the terminal to generate/export image-to-3D assets through canonical JSON-first automation commands.
thesis-control
Use when AI-assisted thesis or manuscript edits risk claim drift, scope creep, loss of intended use, experiment-role promotion, or repeated revisions that fail to converge; provides author-intent control, lightweight or strict contracts, drift audits, revision escalation, and human gates.
argument-governance
Build and audit the manuscript or research-project argument system across intended use, gaps, claims, data, results, experiment roles, contributions, innovation evidence, limitations, and contribution focus. Use when a paper, thesis chapter, review article, or research project needs an explicit argument map…
manuscript-reframe
Reframe report-like academic drafts into paper-form scientific arguments while preserving or explicitly renegotiating author intent; requires an approved old-versus-proposed spine, evidence and argument baselines, analysis-role control, and post-edit drift review.
peer-review
Review another author's manuscript, paper, thesis chapter, proposal, or preprint as an external reviewer. Use when asked to evaluate novelty, significance, gap-contribution fit, claim-evidence adequacy, methods, evaluation, overclaim risks, structure, writing, required revisions, or recommendation without rewriting…