Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add starcat-app/Starcat --skill starcat-cli-releasegit clone --depth 1 https://github.com/starcat-app/StarcatWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/starcat-app/starcat/starcat-cli-release)<a href="https://agentmods.dev/skills/starcat-app/starcat/starcat-cli-release"><img src="https://agentmods.dev/badge/skills/starcat-app/starcat/starcat-cli-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/starcat-app/starcat/starcat-cli-release"><img src="https://agentmods.dev/badge/skills/starcat-app/starcat/starcat-cli-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.01415 |
| Opus 5.5 | $0.00034 | $0.00566 |
| Sonnet 5.5 | $0.00017 | $0.00283 |
| Haiku 4.5 | $0.00009 | $0.00142 |
Grade A, and why
starcat-cli-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Starcat CLI 发版
使用这个 skill 发布 supports/starcat-cli，并把稳定版 GitHub Release 与
supports/homebrew-starcat-cli Formula 当作同一个交付闭环。详细脚本、产物和
失败恢复方式见 references/release-map.md。
硬性规则
- 始终使用中文说明，命令、版本号、路径、环境变量和日志保持原文。
- 遵守根
AGENTS.md：先给方案并获得 dong4j 明确确认，再提交、推送、创建 tag 或触发 Release。 starcat-cli与homebrew-starcat-cli是两个独立 Git 仓库，分别检查 worktree、remote、branch 和最终提交。- 不要手改
internal/mcp.Version；Release 构建通过 tag 和-ldflags注入版本。 - 不复用、不删除、不移动已发布 tag。产物错误时发布新的 patch 版本。
- 不打印
HOMEBREW_TAP_TOKEN；只核对 secret 名称是否存在。 - 预发布 tag 含
-，不会更新 Homebrew Formula；不要把这个预期行为报告成失败。
入口判断
| 用户意图 | 处理方式 |
|---|---|
发布稳定版 X.Y.Z |
更新 Changelog、推送 main、创建 vX.Y.Z，验证 Release、Formula 与 Audit |
发布预发布版 X.Y.Z-rc.N |
创建 prerelease，验证产物；明确跳过 Homebrew Formula |
| 只检查发布准备度 | 只读检查 branch、diff、tag、CI、secret 名称和 workflow，不创建 tag |
| Release 已失败 | 读取同一个 Action 日志，定位失败阶段；不要先重建或覆盖 tag |
| Formula 未更新 | 检查 token、Release 的 Formula step、tap 的 origin/main 和 Audit Action |
标准工作流
- 读取
references/release-map.md。 - 只读检查两个仓库：
git -C supports/starcat-cli status --short --branch
git -C supports/starcat-cli fetch origin main --tags
git -C supports/homebrew-starcat-cli fetch origin main
gh secret list --repo starcat-app/starcat-cli
gh release list --repo starcat-app/starcat-cli
- 明确目标版本、稳定版/预发布版、Changelog 范围、tag 副作用和验证标准。
- 获得确认后更新
supports/starcat-cli/CHANGELOG.md，保留空的## Unreleased，新增## vX.Y.Z - YYYY-MM-DD。 - 运行本地门禁：
go mod verify
go test ./...
go test -race ./...
go vet ./...
go run golang.org/x/vuln/cmd/[email protected] ./...
bash -n scripts/*.sh
- 提交并推送
main，等待该精确 commit 的CIAction 成功。 - 确认本地和远端目标 tag 都不存在，再创建并推送版本 tag。
- 等待目标 tag 对应的
ReleaseAction 到终态。 - 下载 Release 资产，在新临时目录验证 checksums、attestations、压缩包内容和
本机架构二进制的
starcat version。 - 稳定版继续验证
homebrew-starcat-cli的origin/main和Audit FormulaAction；全部成功后才报告发布完成。
Tag 签名
RELEASING.md 默认使用 signed tag。执行前先检查签名能力：
git config --get user.signingkey
git config --get gpg.format
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 120 lines · 85 tokens per session scan A e1484edc1a93
starcat-cli-release is a skill published in the GitHub repository starcat-app/Starcat (210 stars, last pushed yesterday), licensed MIT. It adds 85 tokens to every session and 1,415 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
my-wiki
A skill for managing a local Markdown knowledge vault that stores captured webpages, PDFs, Office files, notes, images, folders, and ZIP files. It links preserved source material, called References, to durable topic pages, called Concepts.
memobase
A Russian-language skill for searching a local knowledge base built from documents and other sources such as web pages, YouTube, audio, and Obsidian notes.
release-note-captain
Use this skill when a project is finished, shipped, deployed, published, or released and the user wants a release note created or updated in Obsidian. It covers collecting release facts, choosing the note path, writing a concise release summary, updating existing notes safely, and preserving follow-up actions.
clone-projects
Clone or sync the project repositories you work on into a local workspace laid out by the same domains as the vault, so notes and code sit side by side. Use when setting up a machine, onboarding a new project, or refreshing all clones.
skill-installer
A cross-platform assistant for installing coding-agent skills on Windows, macOS, and Linux. It adapts installation commands and handles common Git, network, and file-path issues.
chromadb-manager
Query the ChromaDB Manager document base over MCP.