Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/starcat-app/Starcatnpx agentmods add skills/starcat-app/starcat/starcat-releaseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/starcat-app/starcat/starcat-release)<a href="https://agentmods.dev/skills/starcat-app/starcat/starcat-release"><img src="https://agentmods.dev/badge/skills/starcat-app/starcat/starcat-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/starcat-app/starcat/starcat-release"><img src="https://agentmods.dev/badge/skills/starcat-app/starcat/starcat-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.02577 |
| Opus 5.5 | $0.00040 | $0.01031 |
| Sonnet 5.5 | $0.00020 | $0.00515 |
| Haiku 4.5 | $0.00010 | $0.00258 |
Grade A, and why
starcat-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 200 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Starcat 发版
使用这个 skill 选择并执行正确的 Starcat 双渠道发版路径。正式入口是 App Store archive 与 Direct 公开发布两条；不要把 legacy 内测 DMG 流程或通用 macOS 发版流程 当成本仓库的权威正式流程。
硬性规则
- 始终用中文回复，并遵守仓库
AGENTS.md：先给方案并征求 dong4j 明确确认，再修改文件或运行有副作用的发版命令。 - 修改脚本或 skill 的“开干 / 改吧”只授权对应文件修改；真实打包、公证、tag、push、GitHub Release、官网/appcast 上传仍须当前消息明确授权执行对应发布动作。
- 排查时先使用只读命令：
git status、git tag、git ls-remote、--help、读取文件，以及脚本 dry-run 模式。 - 不要为了发版手动修改
project.yml里的版本号字段。Starcat 的版本来自 git tag 和构建脚本。 - Starcat 已发布正式版；修改发版代码时保留线上用户、已发布 tag 和历史产物，不覆盖或复用既有版本。代码层废弃路径仍应一次性收口，不堆叠永久双轨。
- 保留无关未提交文件。工作区不干净时，先判断这些改动是否与发版任务相关，再提出下一步。
入口选择
先判断用户要走哪条路径：
| 用户意图 | 使用入口 | 原因 |
|---|---|---|
| App Store 发布准备、archive、Validate、上传 App Store Connect | scripts/package-appstore.sh / make package-appstore |
构建并校验 Starcat archive；上传继续由 Xcode Organizer / Transporter 完成 |
| Direct 公开发布、Sparkle 更新、starcat.ink 部署、上传 DMG/appcast | scripts/release-direct.sh <X.Y.Z> |
Direct 渠道完整编排入口；发布后还要同步 Homebrew Cask |
| 只在本地构建 Direct 包 | scripts/package-direct.sh <X.Y.Z> |
构建 StarcatDirect DMG，可选 notarization/appcast |
| 历史 ad-hoc 内测 tag + DMG 流程 | scripts/release-store.sh vX.Y.Z |
legacy 入口；默认禁用，必须显式设置 STARCAT_ALLOW_LEGACY_RELEASE=1 |
如果用户只说“发版”但没有说明渠道，先确认是 App Store、Direct，还是双渠道。
如果用户提到 starcat.ink、Sparkle、appcast、notarization 或上传 DMG，可以推断为
Direct；提到 App Store Connect、Organizer、TestFlight 或审核则走 App Store。
两条路径都仍需先给方案并确认再执行。
标准工作流
- 需要细节时先读
references/release-map.md。 - 用只读命令检查当前状态：
git status --shortgit branch --show-currentgit tag --sort=-creatordate | head- Direct 发版可补充：
scripts/release-direct.sh --help
- 说明选择的入口、前提假设、副作用和验证标准。
- 除非用户当前轮已经明确授权执行，否则先等确认。
- 真实发布前优先 dry-run：
- Direct：
STARCAT_RELEASE_DRY_RUN=1 ./scripts/release-direct.sh <X.Y.Z> - App Store 没有发布 dry-run；先完成只读门禁，获授权后运行
make package-appstore，该命令只生成 archive、不上传
- Direct：
- 执行已确认的命令后，验证产物和 URL，并报告精确路径。
App Store 发布
App Store archive 使用 scripts/package-appstore.sh，日常入口：
make package-appstore
make open-appstore-archive
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago Changed · +16 lines c7dca5b6fcc6
- 1mo ago First seen · 184 lines · 100 tokens per session scan A fd6214ec8c07
starcat-release is a skill published in the GitHub repository starcat-app/Starcat (211 stars, last pushed yesterday), licensed MIT. It adds 100 tokens to every session and 2,577 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
my-wiki
A skill for managing a local Markdown knowledge vault that stores captured webpages, PDFs, Office files, notes, images, folders, and ZIP files. It links preserved source material, called References, to durable topic pages, called Concepts.
memobase
A Russian-language skill for searching a local knowledge base built from documents and other sources such as web pages, YouTube, audio, and Obsidian notes.
release-note-captain
Use this skill when a project is finished, shipped, deployed, published, or released and the user wants a release note created or updated in Obsidian. It covers collecting release facts, choosing the note path, writing a concise release summary, updating existing notes safely, and preserving follow-up actions.
clone-projects
Clone or sync the project repositories you work on into a local workspace laid out by the same domains as the vault, so notes and code sit side by side. Use when setting up a machine, onboarding a new project, or refreshing all clones.
skill-installer
A cross-platform assistant for installing coding-agent skills on Windows, macOS, and Linux. It adapts installation commands and handles common Git, network, and file-path issues.
chromadb-manager
Query the ChromaDB Manager document base over MCP.