Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add richkuo/rk-skills --skill sync-docs-releasegit clone --depth 1 https://github.com/richkuo/rk-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/richkuo/rk-skills/sync-docs-release)<a href="https://agentmods.dev/skills/richkuo/rk-skills/sync-docs-release"><img src="https://agentmods.dev/badge/skills/richkuo/rk-skills/sync-docs-release.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 57 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00079 | $0.01094 |
| Opus 5 | $0.00039 | $0.00547 |
| Sonnet 5 | $0.00016 | $0.00219 |
| Haiku 4.5 | $0.00008 | $0.00109 |
Grade A, and why
sync-docs-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
sync-docs-release
Runs three operations in strict sequence, all in the main session. Do not skip steps or reorder them, and do not delegate any step to a subagent — every edit, commit, and release action stays visible in this session.
Step 1 — Sync docs
Invoke the sync-docs skill via the Skill tool and follow it to completion here, passing the user's request plus any session context (target branch, last-sync SHA, specific files).
Summarize the doc edits for the user before proceeding.
Step 2 — Land the doc changes
sync-docs leaves its edits uncommitted in the current checkout. Never commit them to the repository's default branch, and never treat a direct commit as acceptable merely because the checkout happens to be sitting on that branch.
First, if git status shows no doc changes at all, report "no doc changes to commit" and go straight to Step 3.
Otherwise pick the landing path:
- Read the current branch (
git rev-parse --abbrev-ref HEAD) and the default branch (gh repo view --json defaultBranchRef -q .defaultBranchRef.name). - Check the repo's
CLAUDE.md/AGENTS.mdfor a branch, worktree, or pull-request policy. - Choose:
- Branch + PR — the default. Required whenever the checkout is on the default branch or the repo mandates worktree/PR landing, and the right choice whenever the policy is unclear.
- Direct commit — only when the checkout is already on a non-default working branch and no repo rule forbids committing there.
Direct-commit path
- Run
git statusandgit diffto see all changes. - Run
git log --oneline -10to understand the commit message style used in this repo. - Confirm you are NOT on the repository's default branch. If you are, stop and report that instead of committing.
- Stage only documentation files changed by sync-docs (CLAUDE.md, AGENTS.md, SKILL.md, README.md, and any other .md files that were modified — never stage .env, secrets, or unrelated files).
- If there is nothing staged after step 4 (nothing changed), skip the commit and report "no doc changes to commit".
- Otherwise, draft a concise commit message focused on the "why" and create the commit:
git commit -m "$(cat <<'EOF'\n<message>\nEOF\n)". - Run
git statusto verify.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 68 lines · 79 tokens per session scan A cdcc0f69c3c4
sync-docs-release is a skill published in the GitHub repository richkuo/rk-skills (49 stars, last pushed today), licensed MIT. It adds 79 tokens to every session and 1,094 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
github-release
Guides IA through releasing a new version of a GitHub library end-to-end. Handles SemVer versioning and Keep a Changelog formatting automatically.
create-github-pull-request-from-specification
Create GitHub Pull Request for feature request from specification file using pullrequesttemplate.md template.
shipping
Project shipping is authorized immediate delivery execution for identified, already-completed software work. Select only when the user explicitly authorizes an immediate concrete action to commit, push, prepare or create a PR, merge, tag, package, publish, release, deploy, perform an exact repository handoff, or…
gh-cli
GitHub CLI (gh) comprehensive reference for repositories, issues, pull requests, Actions, projects, releases, gists, codespaces, organizations, extensions, and all GitHub operations from the command line.
git-workflow-and-versioning
Structures git workflow practices. Use when making any code change. Use when committing, branching, resolving conflicts, opening or reviewing a pull request (PR), pushing to a remote, or when you need to organize work across multiple parallel streams. Use when cutting a release, choosing a semantic version bump…
finishing-a-development-branch
A process for finishing a completed development branch. A branch is a separate line of code changes that can later be merged or submitted as a pull request.