Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/starcat-app/starcat/starcat-cli-releasenpx skills add starcat-app/Starcat --skill starcat-cli-releasegit clone --depth 1 https://github.com/starcat-app/StarcatWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/starcat-app/starcat/starcat-cli-release)<a href="https://agentmods.dev/skills/starcat-app/starcat/starcat-cli-release"><img src="https://agentmods.dev/badge/skills/starcat-app/starcat/starcat-cli-release.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.01415 |
| Opus 5 | $0.00043 | $0.00707 |
| Sonnet 5 | $0.00017 | $0.00283 |
| Haiku 4.5 | $0.00009 | $0.00142 |
Grade A, and why
starcat-cli-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Starcat CLI 发版
使用这个 skill 发布 supports/starcat-cli，并把稳定版 GitHub Release 与
supports/homebrew-starcat-cli Formula 当作同一个交付闭环。详细脚本、产物和
失败恢复方式见 references/release-map.md。
硬性规则
- 始终使用中文说明，命令、版本号、路径、环境变量和日志保持原文。
- 遵守根
AGENTS.md：先给方案并获得 dong4j 明确确认，再提交、推送、创建 tag 或触发 Release。 starcat-cli与homebrew-starcat-cli是两个独立 Git 仓库，分别检查 worktree、remote、branch 和最终提交。- 不要手改
internal/mcp.Version；Release 构建通过 tag 和-ldflags注入版本。 - 不复用、不删除、不移动已发布 tag。产物错误时发布新的 patch 版本。
- 不打印
HOMEBREW_TAP_TOKEN；只核对 secret 名称是否存在。 - 预发布 tag 含
-，不会更新 Homebrew Formula；不要把这个预期行为报告成失败。
入口判断
| 用户意图 | 处理方式 |
|---|---|
发布稳定版 X.Y.Z |
更新 Changelog、推送 main、创建 vX.Y.Z，验证 Release、Formula 与 Audit |
发布预发布版 X.Y.Z-rc.N |
创建 prerelease，验证产物；明确跳过 Homebrew Formula |
| 只检查发布准备度 | 只读检查 branch、diff、tag、CI、secret 名称和 workflow，不创建 tag |
| Release 已失败 | 读取同一个 Action 日志，定位失败阶段；不要先重建或覆盖 tag |
| Formula 未更新 | 检查 token、Release 的 Formula step、tap 的 origin/main 和 Audit Action |
标准工作流
- 读取
references/release-map.md。 - 只读检查两个仓库：
git -C supports/starcat-cli status --short --branch
git -C supports/starcat-cli fetch origin main --tags
git -C supports/homebrew-starcat-cli fetch origin main
gh secret list --repo starcat-app/starcat-cli
gh release list --repo starcat-app/starcat-cli
- 明确目标版本、稳定版/预发布版、Changelog 范围、tag 副作用和验证标准。
- 获得确认后更新
supports/starcat-cli/CHANGELOG.md，保留空的## Unreleased，新增## vX.Y.Z - YYYY-MM-DD。 - 运行本地门禁：
go mod verify
go test ./...
go test -race ./...
go vet ./...
go run golang.org/x/vuln/cmd/[email protected] ./...
bash -n scripts/*.sh
- 提交并推送
main，等待该精确 commit 的CIAction 成功。 - 确认本地和远端目标 tag 都不存在，再创建并推送版本 tag。
- 等待目标 tag 对应的
ReleaseAction 到终态。 - 下载 Release 资产，在新临时目录验证 checksums、attestations、压缩包内容和
本机架构二进制的
starcat version。 - 稳定版继续验证
homebrew-starcat-cli的origin/main和Audit FormulaAction；全部成功后才报告发布完成。
Tag 签名
RELEASING.md 默认使用 signed tag。执行前先检查签名能力：
git config --get user.signingkey
git config --get gpg.format
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 120 lines · 85 tokens per session scan A e1484edc1a93
starcat-cli-release is a skill published in the GitHub repository starcat-app/Starcat (133 stars, last pushed 3d ago), licensed MIT. It adds 85 tokens to every session and 1,415 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
os-rust-backend
Use when working on a Rust backend that follows the Open Software Network house style — the seven-crate Cargo workspace split (domain / services / persistence / providers / config / api / app) shared by os-accounts and os-platform (fellow). Trigger on: scaffolding a new service in this org ("like os-accounts"…
rust-unit-tests
Write, improve, and run Rust unit tests in the warp Rust codebase.
os-accounts-integration
Integrate consumer apps, Tauri desktop clients, or backend services with OS Accounts, the Open Software identity and credit-billing platform. Use when adding Login with Open Software, PKCE callback handling, /me, access-token verification with JWKS/ES256, auth middleware for Hono/Fastify/Express/Rust, top-up links…
rpce-swift-concurrency-fix
Diagnose and repair a bounded set of Swift concurrency compiler errors or warnings in RepoPrompt CE, including actor isolation, Sendable crossings, task captures, continuations, cancellation, global mutable state, and Objective-C interoperability. Use for a specific diagnostic, file, target, or coherent diagnostic…
boutique-best-practices
Best practices for using Boutique with Swift 6 concurrency, @Observable, @ObservationIgnored, Sendable conformance, testing with preview stores, and dependency injection. Use when troubleshooting Boutique issues, migrating to Swift 6, or setting up tests.
ios-development
Skill "ios-development" from CoWork-OS/CoWork-OS, covering ios development, purpose, routing, trigger examples and positive.