Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/shaharia-lab/slackcli/releasenpx skills add shaharia-lab/slackcli --skill releasegit clone --depth 1 https://github.com/shaharia-lab/slackcliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00087 | $0.01770 |
| Opus 5 | $0.00044 | $0.00885 |
| Sonnet 5 | $0.00017 | $0.00354 |
| Haiku 4.5 | $0.00009 | $0.00177 |
Grade A, and why
release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cutting a SlackCLI release
A release is two separate things, in this order:
- A PR onto
mainthat bumpspackage.jsonand promotes theCHANGELOG. Reversible. - An annotated tag pushed to that merged commit. This is the irreversible, outward-facing step —
release.ymlbuilds and publishes public binaries, and force-updates the Homebrew tap atshaharia-lab/homebrew-tap.
Never do step 2 without explicit human confirmation. See Gate before tagging.
Hard constraints
These are the ways a release goes wrong. Check them, don't rediscover them.
release.ymlfails when the tag disagrees withpackage.json(#82). The bump must be merged intomainbefore the tag is pushed. Fixing it after the fact means bumpingmainand then deleting and re-pushing the tag.mainrequires signed commits, with no bypass actors — an unsigned commit makes the PR unmergeable for anyone, including admins. Verify the release commit carries a signature.- The repository constitution in
CLAUDE.mdapplies to the release PR too: it needs a linked GitHub issue carryingready-for-prbefore the PR is opened.pr-linked-issue.ymlenforces the link as a required check. mainrequires one approving review, and an agent cannot approve its own PR. Sogh pr mergereportsBLOCKED/REVIEW_REQUIREDeven when every check is green. Unblocking it is the maintainer's decision, taken one of two ways — a review, or an explicit instruction to merge with--admin. Never pick--adminon your own initiative; surface the block and let the maintainer choose.dismiss_stale_reviews_on_pushis on, so any push after an approval discards it — get the branch final before asking for review.- Pre-commit hooks block direct commits to
main. Always work on a branch. - A merged PR does not guarantee a
CHANGELOGentry. Reconcile commits against[Unreleased]yourself — the mrkdwn fix in #96 landed with no entry and had to be backfilled at v0.9.0. bunmay not be onPATHin a non-interactive shell. Ifbunis not found, useexport PATH="$HOME/.bun/bin:$PATH".
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 130 lines · 87 tokens per session scan A 1e5e8bbd2d4d
release is a skill published in the GitHub repository shaharia-lab/slackcli (136 stars, last pushed 2d ago), licensed MIT. It adds 87 tokens to every session and 1,770 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
push-release
Push to GitHub and optionally bump version to trigger PyPI release.
omh-deploy-and-monitor
This is a Hermes-native deploy-and-monitor workflow skill.
git-wrapup
Land working-tree changes as logical commits — the work grouped by concern, topped by a release commit (version bump, changelog, regenerated artifacts) and an annotated tag. Verify, commit, tag. Stops at "committed and tagged locally" — no push, no publish. The release-and-publish skill picks up from here. Distilled…
release-and-publish
Ship a release end-to-end across every registry the project targets (npm, MCP Registry, GitHub Releases for .mcpb bundles, GHCR). Runs the final verification gate, pushes commits and tags, then publishes to each applicable destination. Assumes git wrapup (version bumps, changelog, commit, annotated tag) is already…
release-notes
Draft user-facing release notes from a git log range. Trigger when the user asks for "release notes", "changelog entry", or "what shipped this week" with a git ref range. Output is markdown sections grouped by Features / Fixes / Breaking with PR links.
prepare-release
End-to-end release automation — reads commits since last tag, infers semver bump, drafts changelog, creates release PR, merges it, waits for CI green, tags, and monitors the Docker build to completion. Use when the user says: prepare release, cut a release, bump version, create release PR, ship a new version, tag a…