What is plugin-publish?

A publishing workflow for plugin changes that checks the files, prepares a selected commit, sends it to the configured Git remote, and opens a pull request.

Use it when you are ready to publish plugin changes for review. It is not intended for automated release version updates or certain documentation-only changes.

It reduces mistakes in the release process, such as invalid commit or pull-request titles, skipped checks, or accidentally including unrelated files.

How racecraft-lab/racecraft-plugins-public configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to racecraft-lab/racecraft-plugins-public. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/racecraft-lab/racecraft-plugins-public/main/.claude/skills/plugin-publish/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/racecraft-lab/racecraft-plugins-public

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/racecraft-lab/racecraft-plugins-public/plugin-publish/github.svg)](https://agentmods.dev/skills/racecraft-lab/racecraft-plugins-public/plugin-publish)

Your own site

<a href="https://agentmods.dev/skills/racecraft-lab/racecraft-plugins-public/plugin-publish"><img src="https://agentmods.dev/badge/skills/racecraft-lab/racecraft-plugins-public/plugin-publish/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/racecraft-lab/racecraft-plugins-public/plugin-publish"><img src="https://agentmods.dev/badge/skills/racecraft-lab/racecraft-plugins-public/plugin-publish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 80 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 621 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00080	$0.00621
Opus 5.5	$0.00032	$0.00248
Sonnet 5.5	$0.00016	$0.00124
Haiku 4.5	$0.00008	$0.00062

Measured 26d ago against content hash cc4c02f0c096, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

plugin-publish scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 26d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/plugin-publish/SKILL.md · 46 lines

How it starts

The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.

plugin-publish

User-invocable. Stops Claude from auto-running this — it has side effects (push, PR).

What this does

Walks through the publish flow in the root AGENTS.md (Commands, Pull Requests, Definition of Done) and enforces the parts that are easy to forget:

Pre-flight check — python3 tests/speckit-pro/run-all.py --layer 1 must pass (catches missing frontmatter and invalid JSON).
Detect remote — run git remote -v; do not assume the remote is named origin.
Stage selectively — list candidate files, ask user which to include. NEVER git add -A or git add ..
Commit with conventional-commits prefix — required types: feat, fix, chore, docs, refactor, test. Validate before writing.
Push and open the PR — follow the Pull Requests section of the root AGENTS.md, which opens every PR with the gh-stack skill. Validate the final title with the release-readiness gate first. For feat and fix PRs, fill the release-note fence or apply the release-note/skip label.
Remind user — after PR is merged (squash-only), tell them to run:
```
/plugin marketplace update racecraft-plugins-public
```

When NOT to use

For a release (release-please handles version bumps automatically — do not manually edit plugin.json versions)
For docs-only PRs; commit and open the PR directly.
For version fields in release-please-config.json, .release-please-manifest.json, or the marketplace registries: release automation owns them (see the Release Automation section of docs-site/src/content/docs/contribute-and-release.md).

Hard rules

Never merge the PR; a human reviews and merges it.
Never use --no-verify to skip hooks
Never push to main directly (branch protection blocks it; use a feature branch + PR)
PR title format: <type>(<lowercase-scope>): <description>. The scope is required: the validate-pr-title CI job rejects a title without one.

Output

When complete, report:

Branch name pushed
PR URL
The marketplace-update command the user needs to run post-merge

Read the full file on GitHub · 46 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

26d ago Changed cc4c02f0c096
1mo ago Changed eeee8325b289
1mo ago First seen · 46 lines · 80 tokens per session scan A 33a85704a0e6

Subscribe to this mod's changes

plugin-publish is a skill published in the GitHub repository racecraft-lab/racecraft-plugins-public (5 stars, last pushed 6d ago), licensed MIT. It adds 80 tokens to every session and 621 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Commits Git and workflow claude-plugins mcp skills spec-driven-development

speq-git-discipline

Read-only git guardrails. No history writes, verify changes before completing. Used by speq agents. Not for general git work.

marconae/speq-skill · 34 tokens

gitops

Git operations wrapper: sync, stage, commit, push. Generates Conventional Commits messages with .scratch artifact references. Use when the user says gitops, commit, push, sync code, or needs version control operations.

yugasun/aiops · 47 tokens

git-workflow-and-versioning

Structures git workflow practices. Use when making any code change. Use when committing, branching, resolving conflicts, splitting uncommitted work in a messy working tree into clean atomic commits, opening or reviewing a pull request (PR), pushing to a remote, or when you need to organize work across multiple…

addyosmani/agent-skills · 89 tokens

racecraft-plugins-public: Skill for Claude Code