Borrowing it
Nothing to install: this file belongs to starcat-app/Starcat. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/starcat-app/Starcat/main/.claude/skills/starcat-release/SKILL.mdgit clone --depth 1 https://github.com/starcat-app/StarcatWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/starcat-app/starcat/starcat-release)<a href="https://agentmods.dev/skills/starcat-app/starcat/starcat-release"><img src="https://agentmods.dev/badge/skills/starcat-app/starcat/starcat-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/starcat-app/starcat/starcat-release"><img src="https://agentmods.dev/badge/skills/starcat-app/starcat/starcat-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.02288 |
| Opus 5 | $0.00050 | $0.01144 |
| Sonnet 5 | $0.00020 | $0.00458 |
| Haiku 4.5 | $0.00010 | $0.00229 |
Grade A, and why
starcat-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 184 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Starcat 发版
使用这个 skill 选择并执行正确的 Starcat 双渠道发版路径。正式入口是 App Store archive 与 Direct 公开发布两条；不要把 legacy 内测 DMG 流程或通用 macOS 发版流程 当成本仓库的权威正式流程。
硬性规则
- 始终用中文回复，并遵守仓库
AGENTS.md：先给方案并征求 dong4j 明确确认，再修改文件或运行有副作用的发版命令。 - 除非用户在当前对话中明确说“开干 / 执行 / 发布 / GO / 动手”，否则不要运行真实发布、部署、上传、
git tag、git push、rsync、ssh、notarization 或 appcast 写入命令。 - 排查时先使用只读命令：
git status、git tag、git ls-remote、--help、读取文件，以及脚本 dry-run 模式。 - 不要为了发版手动修改
project.yml里的版本号字段。Starcat 的版本来自 git tag 和构建脚本。 - Starcat 已发布正式版；修改发版代码时保留线上用户、已发布 tag 和历史产物，不覆盖或复用既有版本。代码层废弃路径仍应一次性收口，不堆叠永久双轨。
- 保留无关未提交文件。工作区不干净时，先判断这些改动是否与发版任务相关，再提出下一步。
入口选择
先判断用户要走哪条路径：
| 用户意图 | 使用入口 | 原因 |
|---|---|---|
| App Store 发布准备、archive、Validate、上传 App Store Connect | scripts/package-appstore.sh / make package-appstore |
构建并校验 Starcat archive；上传继续由 Xcode Organizer / Transporter 完成 |
| Direct 公开发布、Sparkle 更新、starcat.ink 部署、上传 DMG/appcast | scripts/release-direct.sh <X.Y.Z> |
Direct 渠道完整编排入口；发布后还要同步 Homebrew Cask |
| 只在本地构建 Direct 包 | scripts/package-direct.sh <X.Y.Z> |
构建 StarcatDirect DMG，可选 notarization/appcast |
| 历史 ad-hoc 内测 tag + DMG 流程 | scripts/release-store.sh vX.Y.Z |
legacy 入口；默认禁用，必须显式设置 STARCAT_ALLOW_LEGACY_RELEASE=1 |
如果用户只说“发版”但没有说明渠道，先确认是 App Store、Direct，还是双渠道。
如果用户提到 starcat.ink、Sparkle、appcast、notarization 或上传 DMG，可以推断为
Direct；提到 App Store Connect、Organizer、TestFlight 或审核则走 App Store。
两条路径都仍需先给方案并确认再执行。
标准工作流
- 需要细节时先读
references/release-map.md。 - 用只读命令检查当前状态：
git status --shortgit branch --show-currentgit tag --sort=-creatordate | head- Direct 发版可补充：
scripts/release-direct.sh --help
- 说明选择的入口、前提假设、副作用和验证标准。
- 除非用户当前轮已经明确授权执行，否则先等确认。
- 真实发布前优先 dry-run：
- Direct：
STARCAT_RELEASE_DRY_RUN=1 ./scripts/release-direct.sh <X.Y.Z> - App Store 没有发布 dry-run；先完成只读门禁，获授权后运行
make package-appstore，该命令只生成 archive、不上传
- Direct：
- 执行已确认的命令后，验证产物和 URL，并报告精确路径。
App Store 发布
App Store archive 使用 scripts/package-appstore.sh，日常入口：
make package-appstore
make open-appstore-archive
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 184 lines · 100 tokens per session scan A fd6214ec8c07
starcat-release is a skill published in the GitHub repository starcat-app/Starcat (154 stars, last pushed yesterday), licensed MIT. It adds 100 tokens to every session and 2,288 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
memobase
A Russian-language skill for searching a local knowledge base built from documents and other sources such as web pages, YouTube, audio, and Obsidian notes.
chromadb-manager
Query the ChromaDB Manager document base over MCP.
clone-projects
Clone or sync the project repositories you work on into a local workspace laid out by the same domains as the vault, so notes and code sit side by side. Use when setting up a machine, onboarding a new project, or refreshing all clones.
skill-installer
A cross-platform assistant for installing coding-agent skills on Windows, macOS, and Linux. It adapts installation commands and handles common Git, network, and file-path issues.
mem0-test-integration
Verify a Mem0 integration produced by /mem0-integrate. Runs in the same workspace on the same branch (loose coupling) — installs dependencies, runs the repo's native test suite, then exercises a real end-to-end smoke flow against the user's API key. Produces a scorecard. TRIGGER when: user has just run /mem0-integrate…
github
Use when interacting with GitHub repositories, authentication, remotes, pushes, or repository creation through the GitHub CLI and related git workflows.