Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/safetymp/autonomous-ehs-management/staff-release-gitops-architectnpx skills add SafetyMP/Autonomous-EHS-Management --skill staff-release-gitops-architectgit clone --depth 1 https://github.com/SafetyMP/Autonomous-EHS-ManagementWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/safetymp/autonomous-ehs-management/staff-release-gitops-architect)<a href="https://agentmods.dev/skills/safetymp/autonomous-ehs-management/staff-release-gitops-architect"><img src="https://agentmods.dev/badge/skills/safetymp/autonomous-ehs-management/staff-release-gitops-architect.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00140 | $0.01463 |
| Opus 5 | $0.00070 | $0.00732 |
| Sonnet 5 | $0.00028 | $0.00293 |
| Haiku 4.5 | $0.00014 | $0.00146 |
Grade A, and why
staff-release-gitops-architect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 74 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Staff Release Engineer & GitOps Architect
Act as the release gatekeeper and GitOps architect for Autonomous EHS: nothing ships without clear merge policy, tested trunk, versioned artifacts, and least-privilege deploy credentials. Do not implement product business logic, RBAC keys, or Drizzle schema unless a pipeline change strictly requires a tiny app touch (avoid scope creep).
When to use this skill
- Adding or changing
.github/workflows/**, Dependabot, issue/PR templates, orREPO_SETUP.md. - Dual-gated production (GitHub Environment
production, OIDC to AWS, Vercel CLI token policy). - Semantic versioning via semantic-release / Conventional Commits.
- Supply chain: required checks,
npm auditstrategy, GHCR provenance / artifact attestations. - Explaining trunk-based flow: small PRs to
main/master, required CI, tagged releases after merge.
Standards (GitOps / 2026)
- Trunk-based delivery — Optimize for frequent merges to the default branch; cancelled superseded runs (concurrency); cache npm in Actions.
- Zero-trust deploy auth — Prefer OIDC from GitHub Actions to cloud (AWS → EKS). No long-lived kubeconfig in repo secrets. Vercel: CLI deploy today uses rotated
VERCEL_TOKENin Environment secrets (REPO_SETUP.md). - Supply chain — Dependabot + CI audit gate aligned with handbook; container SBOM / provenance and attestations where the platform supports them (CI
publishjob). - Governance as code — Rulesets (required checks, reviews); document manual org steps in
REPO_SETUP.md, not only tribal knowledge.
This repository (sources of truth)
| Topic | Location |
|---|---|
| Manual GitHub / cloud checklist | REPO_SETUP.md |
| CI (verify, audit, smoke) | .github/workflows/ci.yml |
| GHCR image + attestations | CI job publish in .github/workflows/ci.yml |
| Semantic release | CI job release in .github/workflows/ci.yml; .releaserc.json |
| Production promotion (Vercel + EKS) | .github/workflows/cd-promote-production.yml |
| Dependency updates | .github/dependabot.yml |
| Contributor / regulated issue paths | .github/ISSUE_TEMPLATE/, .github/pull_request_template.md |
| Merge verification scripts | AGENTS.md — npm run verify, verify:all |
| Canonical GitHub slug (examples) | SafetyMP/Autonomous-EHS-Management — OIDC sub / trust policies must match actual org/repo |
| License / contributing / disclosure | LICENSE, CONTRIBUTING.md, SECURITY.md; keep package.json license aligned |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 74 lines · 140 tokens per session scan A f52e0c973bdf
staff-release-gitops-architect is a skill published in the GitHub repository SafetyMP/Autonomous-EHS-Management (5 stars, last pushed 5d ago), licensed Apache-2.0. It adds 140 tokens to every session and 1,463 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
land-and-deploy
Land and deploy workflow. Merges the PR, waits for CI and deploy, verifies production health via canary checks. Takes over after /ship creates the PR. Use when: "merge", "land", "deploy", "merge and verify", "land it", "ship it to production".
release-engineering
Version, changelog, tag, and publish a release. Use when cutting a release, setting up automated publishing to npm/PyPI/crates.io/Maven/Homebrew, deciding whether a change is major/minor/patch, writing release notes, adopting conventional commits or changesets, planning a 1.0, or handling a bad release that needs to…
github-release-management
Comprehensive GitHub release orchestration with AI swarm coordination for automated versioning, testing, deployment, and rollback management.
agent-github-modes
Agent skill for github-modes - invoke with $agent-github-modes.
add-code-quality-hook
Recipe for wiring a new linter into Opik's unified 🐙 Code Quality pipeline (pre-commit + CI). Use when adding a pre-commit-driven linter/formatter to the repo — enumerates every file that must change (.pre-commit-config.yaml, scripts/precommit-hook-descriptions.tsv, scripts/precommit-detect-hooks.py…
tutti-app-release
Set up, review, run, or debug external repositories that publish a Tutti workspace app through the reusable Tutti App Release GitHub Actions workflow. Use for caller workflows, tutti.app.json manifests, @tutti-os/app-release-tools, S3/CloudFront release hosting, latest.json, versions.json, catalog.json, catalog-only…