Borrowing it
Nothing to install: this file belongs to receptron/mulmoclaude. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/receptron/mulmoclaude/main/.claude/skills/publish-mulmoclaude/SKILL.mdgit clone --depth 1 https://github.com/receptron/mulmoclaudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/receptron/mulmoclaude/publish-mulmoclaude)<a href="https://agentmods.dev/skills/receptron/mulmoclaude/publish-mulmoclaude"><img src="https://agentmods.dev/badge/skills/receptron/mulmoclaude/publish-mulmoclaude/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/receptron/mulmoclaude/publish-mulmoclaude"><img src="https://agentmods.dev/badge/skills/receptron/mulmoclaude/publish-mulmoclaude.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 9 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 125 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 164 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 125 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 164 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium MCP Rug Pull · line 91 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 173 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 245 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 160 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Rogue Agent · line 279 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.05859 |
| Opus 5.5 | $0.00014 | $0.02344 |
| Sonnet 5.5 | $0.00007 | $0.01172 |
| Haiku 4.5 | $0.00004 | $0.00586 |
Grade B, and why
publish-mulmoclaude scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf /tmp/mc-test && mkdir /tmp/mc-test && cd /tmp/mc-test Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
( while ! curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:3097/ 2>/dev/null | grep -q 200; do sleep 1; done; echo OK ) How it starts
The opening of the file, as written. The whole thing — 325 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Publish MulmoClaude
mulmoclaude is a launcher that bundles the whole app into one npm package. Unlike /publish (which handles a single self-contained package), this flow has three traps that bit us on 0.1.0:
- The package's
dependenciesmust cover everyimport "…"inserver/— the rootpackage.jsonisn't shipped, so implicit inheritance doesn't exist. @mulmobridge/*workspace packages can drift — localsrc/adds exports without a version bump, sonpm installresolves to an older publisheddist/that's missing them. All dependents fail at runtime.prepare-dist.jsruns viaprepack, so bothnpm packandnpm publishinvoke it — but you still needyarn buildfirst (fordist/client/) andyarn build:packagesif any workspace package was bumped. (Earlier versions usedprepublishOnly, which npm 10+ no longer fires onnpm pack, so the §4 tarball test silently shipped a 4-file stub.)
CI coverage — the first-line defence
As of PR #669 / #688, all three traps run automatically on every PR that touches the launcher via .github/workflows/mulmoclaude_smoke.yaml, driven by scripts/mulmoclaude/smoke.mjs:
- §1 deps audit →
scripts/mulmoclaude/deps.mjs— bare imports + dynamicimport("pkg")inserver/*.tschecked againstpackages/mulmoclaude/package.json(includingoptionalDependencies/peerDependencies). - §2 workspace drift →
scripts/mulmoclaude/drift.mjs— localsrc/index.tsvalue-export lines compared against the registry-published dist (fetched fromregistry.npmjs.org+unpkg), notnode_modules— the workspace symlink would otherwise always match. - §4 tarball boot →
scripts/mulmoclaude/tarball.mjs—npm pack+ clean install + launcher start withDISABLE_SANDBOX=1and a stubbedclaudeCLI + HTTP 200 on/.
Before releasing, the go/no-go is: "latest MulmoClaude publish smoke run on main is green." Run the manual steps below only if you need to cover a scenario CI doesn't (e.g. the --force publish path, or publishing a cascaded @mulmobridge/* dep).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed b914dc68e5cf
- 1mo ago Changed · +25 lines d94440c4b3b4
- 1mo ago Changed · -9 lines 3a7bf772f8b5
- 1mo ago First seen · 309 lines · 36 tokens per session scan B bd66dd251ccd
publish-mulmoclaude is a skill published in the GitHub repository receptron/mulmoclaude (386 stars, last pushed 2d ago), licensed MIT. It adds 36 tokens to every session and 5,859 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it B with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
github-repo-management
Clone, create, fork, configure, and manage GitHub repositories. Manage remotes, secrets, releases, and workflows. Works with gh CLI or falls back to git + GitHub REST API via curl.
updater_guide
Guidance for checking for and installing Row-Bot updates.
pre-release-check
The final gate before a release is cut — go green, reconcile the release PR against what actually landed, sweep what CI can't see, check the roadmap and ADR statuses, optionally deep-review, then return a ship-or-hold verdict.
land-and-deploy
Merge PR, wait for CI, verify deploy, run canary. The complete landing pipeline.
release-notes-generator
Generate release notes in 3 formats (CHANGELOG.md, PR body, Slack announcement) from git commits. Automatically categorizes changes and converts technical language to user-friendly messaging. Use for releases, changelogs, version notes, what's new summaries, or ship announcements.
release-notes
Generate release notes in multiple formats from git commits.