Borrowing it
Nothing to install: this file belongs to silo-code/silo. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/silo-code/silo/main/.agents/skills/silo-release-publish/SKILL.mdgit clone --depth 1 https://github.com/silo-code/siloWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/silo-code/silo/silo-release-publish)<a href="https://agentmods.dev/skills/silo-code/silo/silo-release-publish"><img src="https://agentmods.dev/badge/skills/silo-code/silo/silo-release-publish/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/silo-code/silo/silo-release-publish"><img src="https://agentmods.dev/badge/skills/silo-code/silo/silo-release-publish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
SkillSpector: 1 finding, up to low
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- low Supply Chain · line 97 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.01749 |
| Opus 5.5 | $0.00034 | $0.00700 |
| Sonnet 5.5 | $0.00017 | $0.00350 |
| Haiku 4.5 | $0.00008 | $0.00175 |
Grade A, and why
silo-release-publish scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sL https://github.com/silo-code/silo/releases/latest/download/latest.json \ How it starts
The opening of the file, as written. The whole thing — 154 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Publishing a Silo release
Silo app releases land as drafts on purpose — a soak-test checkpoint before
they go public (see apps/docs/guide/release-channels.md). Publishing is a
separate, manual step, and it is the moment the release becomes real: GitHub's
"Latest" slot, the website download button, the docs download links, and every
existing install's auto-updater all follow /releases/latest immediately.
Because drafts accumulate silently, the version you're asked to publish is often not one version ahead of what users are running. Always establish the gap before writing notes.
Package releases (
sdk-*,git-api-*) are pre-releases and are published by CI. This skill is only forsilo-v*app releases.
1. Establish the gap
gh release list --limit 10
gh api repos/silo-code/silo/releases --jq '.[] | select(.draft==false) | select(.tag_name|startswith("silo-")) | .tag_name' | head -3
The first published silo-v* tag is what users are actually on. Every draft
between it and the one you're publishing is a version whose changes ship
silently unless you fold them into the notes.
2. Verify the draft is complete
gh release view silo-vX.Y.Z --json name,isDraft,isPrerelease,tagName,assets \
--jq '"draft:\(.isDraft) pre:\(.isPrerelease)", (.assets[] | "\(.name) \(.size) \(.state)")'
Do not publish unless all of these are present and uploaded:
latest.json— the updater manifest- macOS:
Silo_X.Y.Z_aarch64.dmg,Silo_X.Y.Z_x64.dmg,Silo_aarch64.app.tar.gz(+.sig),Silo_x64.app.tar.gz(+.sig) - Windows:
Silo_X.Y.Z_x64-setup.exe(+.sig),Silo_X.Y.Z_x64_en-US.msi(+.sig) - Linux:
Silo_X.Y.Z_amd64.AppImage(+.sig),Silo_X.Y.Z_amd64.deb(+.sig),Silo-X.Y.Z-1.x86_64.rpm(+.sig)
A missing .sig means the updater will reject the build for that platform — stop
and investigate rather than publishing a partial release.
Confirm latest.json names the version you expect:
gh api -H "Accept: application/octet-stream" \
"$(gh release view silo-vX.Y.Z --json assets --jq '.assets[]|select(.name=="latest.json")|.apiUrl')" \
| python3 -c "import json,sys; print(json.load(sys.stdin)['version'])"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +33 lines 661b03ba0428
- 1mo ago First seen · 121 lines · 84 tokens per session scan A 144a0a5a8b5e
silo-release-publish is a skill published in the GitHub repository silo-code/silo (62 stars, last pushed today), licensed MIT. It adds 84 tokens to every session and 1,749 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cmux-release
Prefer the /release command. It determines the new version (minor by default), gathers the Changelog line from each PR merged since the last stable tag, updates CHANGELOG.md, runs ./scripts/bump-version.sh, commits, runs ./scripts/release-pretag-guard.sh, then tags and pushes.
create-draft-pr
Create a draft pull request for the current session. Use when the user wants to open a draft PR with the session's changes.
create-pr
Create a pull request for the current session. Use when the user wants to open a PR with the session's changes.
release
Generic release assistant — analyzes repo release rules, caches them in .omc/RELEASERULE.md, then guides the release.
release
Use this skill for EVERY ClawRouter release. Enforces the full checklist — version sync, CHANGELOG, build, tests, npm publish, git tag, GitHub release. No step can be skipped.
release
Release a new version of the DevoxxGenie IntelliJ plugin — prompt for the target version, bump it in the build files, write a curated CHANGELOG.md entry and plugin.xml change-notes from the git/PR history since the last tag, build to verify, then commit, tag, and publish a matching GitHub release. Use this whenever…