Borrowing it
Nothing to install: this file belongs to starcat-app/Starcat. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/starcat-app/Starcat/main/.claude/skills/starcat-backend-release/SKILL.mdgit clone --depth 1 https://github.com/starcat-app/StarcatWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/starcat-app/starcat/starcat-backend-release)<a href="https://agentmods.dev/skills/starcat-app/starcat/starcat-backend-release"><img src="https://agentmods.dev/badge/skills/starcat-app/starcat/starcat-backend-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/starcat-app/starcat/starcat-backend-release"><img src="https://agentmods.dev/badge/skills/starcat-app/starcat/starcat-backend-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.00810 |
| Opus 5 | $0.00042 | $0.00405 |
| Sonnet 5 | $0.00017 | $0.00162 |
| Haiku 4.5 | $0.00008 | $0.00081 |
Grade A, and why
starcat-backend-release scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Fly：`fly status -a <app>` 和 `curl https://<app>.fly.dev/healthz` 正常。 What it actually says
Starcat 后端 API 发布
使用这个 skill 处理 supports/starcat-*-api 独立后端仓库的发布流程。它不同于主 App 的 starcat-release，也不同于日常 Fly 运维的 starcat-supports-ops。
硬性规则
- 先只读检查，再说明发布计划；等 dong4j 明确确认后才能执行
deploy.sh、git push、gh pr merge、git tag。 - 发布脚本会影响 GitHub PR、tag、GitHub Actions 和 Fly deploy，不要在未确认时运行。
- 默认不要删除远端 tag 或强推。
- 工作区必须干净；发现无关 dirty files 时停止并说明。
- 不要把主 App 的
scripts/release-direct.sh用到 supports 子项目。
入口选择
| 项目 | 发布入口 | 说明 |
|---|---|---|
| sharing/trending/weekly/wiki | supports/<project>/scripts/deploy.sh vX.Y.Z |
完整 PR -> merge -> tag -> Actions/Fly 流程 |
| recommend | supports/starcat-recommend-api/scripts/deploy.sh vX.Y.Z |
先跑 Go 测试/构建，再本地 tag + push tag |
| discovery | supports/starcat-discovery-api/scripts/deploy.sh vX.Y.Z |
直接 fly deploy -a starcat-discovery-api --build-arg VERSION=... |
如果用户没说明具体服务，先问服务名和目标版本号。版本必须是 vX.Y.Z。
标准工作流
- 读取
references/backend-release-map.md。 - 进入目标 supports 子项目目录。
- 只读检查：
git status --shortgit branch --show-currentgit tag --list 'v*' --sort=-v:refname | headgh auth status
- 先跑 dry-run，适用于 sharing/trending/weekly/wiki：
./scripts/deploy.sh --dry-run vX.Y.Z
- 说明脚本将创建 PR、合并、切 main、打 tag、push tag，并触发 CI/Fly。
- 等确认后执行真实发布。
- 发布后检查 GitHub Actions 和 Fly 状态。
关键约束
- sharing/trending/weekly/wiki 的 tag 必须在 PR merge 后创建，指向 main 的 merge commit。
- 不允许在 main/master 上运行共享 deploy 脚本。
- 不能用 squash merge，否则会丢失 dev 上多个 commit 信息。
- 推 tag 后必须等 Go workflow 成功，Fly deploy/release 才会继续。
- recommend/discovery 的脚本更简单，不等同于共享 deploy 流程，使用前必须先读脚本。
验证
- GitHub：PR 已合并，tag 存在且指向 main 期望 commit。
- Actions：Go workflow 通过，后续 Fly deploy/release 按预期触发。
- Fly：
fly status -a <app>和curl https://<app>.fly.dev/healthz正常。
参考
详细项目差异、命令和失败恢复见 references/backend-release-map.md。
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 60 lines · 83 tokens per session scan A 0ebc8725cc26
starcat-backend-release is a skill published in the GitHub repository starcat-app/Starcat (159 stars, last pushed today), licensed MIT. It adds 83 tokens to every session and 810 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
scope-creep-detector
Analyzes git diffs against a stated intent to detect scope creep, unrelated files, broad pull requests, changes that grew beyond a fix, dependency additions, public API renames, config or CI edits, oversized hunks, and formatting-only files. Use when the user asks whether a change grew beyond the fix, a PR is too…
mem0-test-integration
Verify a Mem0 integration produced by /mem0-integrate. Runs in the same workspace on the same branch (loose coupling) — installs dependencies, runs the repo's native test suite, then exercises a real end-to-end smoke flow against the user's API key. Produces a scorecard. TRIGGER when: user has just run /mem0-integrate…
wegent-knowledge
Knowledge base management and search tools for Wegent. Provides capabilities to list, create, update, and search knowledge bases and documents using RAG retrieval. Use this skill when the user wants to manage knowledge bases, documents, or search for information programmatically.
binder-app
Build a small HTTP app (dashboard, kanban board, admin panel, custom UI) on top of an existing Binder workspace. Use when asked to "create an app", "build a dashboard", "show records in a chart", "make a kanban/board", "build an admin panel", or "add a UI on top of binder".
astra-vector-backend
Design Astra DB Data API and vector-search backends for retrieval, metadata filtering, and LangChain-compatible stores.
s-gw
Use s-gw when working with credentials, private keys, API tokens, SSH identities, browser credentials, or other sensitive data in agentic coding workflows. Prefer typed handles and local approved execution over exposing raw secret values to a model.