Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/steipete/codexbar/release-codexbarnpx skills add steipete/CodexBar --skill release-codexbargit clone --depth 1 https://github.com/steipete/CodexBarWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00027 | $0.01574 |
| Opus 5 | $0.00014 | $0.00787 |
| Sonnet 5 | $0.00005 | $0.00315 |
| Haiku 4.5 | $0.00003 | $0.00157 |
Grade A, and why
release-codexbar scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CodexBar Release
Use for releasing signed/notarized macOS apps, especially repos with Sparkle appcasts and Homebrew casks.
Start
- Work from the app repo unless asked otherwise.
- Check repo state, current version, latest tag/release, and release docs/scripts.
- Confirm
CHANGELOG.mdis complete, user-facing, deduped, and dated for the release. - Prefer the repo release script; patch small script/test blockers instead of bypassing the release path.
- Never print key material. Keep 1Password references and local key paths as references only.
- Load
$release-privateif it exists before resolving Peter-owned credential locators.
Key Material
Use $one-password for secret handling. op only in tmux/persistent shell; no broad env, set, export -p, or secret scans.
Known App Store Connect shape:
- fields:
private_key_p8,key_id,issuer_id - keep all three fields from the same 1Password item; do not mix with stale values from
~/.profile - resolve Peter-owned item refs from
$release-private
Known Sparkle key:
- resolve the private key file from
$release-private - pass as
SPARKLE_PRIVATE_KEY_FILE
Safe env file pattern:
APP_STORE_CONNECT_API_KEY_P8=<1Password ref from release-private>
APP_STORE_CONNECT_KEY_ID=<1Password ref from release-private>
APP_STORE_CONNECT_ISSUER_ID=<1Password ref from release-private>
SPARKLE_PRIVATE_KEY_FILE=<path from release-private>
Run with op run --account my.1password.com --env-file <file> -- <script>, then delete the temp env file.
CodexBar
Paths:
- repo:
~/Projects/codexbar - release script:
Scripts/release.sh - signing/notarization:
Scripts/sign-and-notarize.sh - appcast:
Scripts/make_appcast.sh,appcast.xml - release assets:
CodexBar-macos-universal-<version>.zip,CodexBar-macos-universal-<version>.dSYM.zip - packaged app:
CodexBar.app - version file:
version.env - changelog:
CHANGELOG.md - Homebrew tap:
~/Projects/homebrew-tap - cask:
~/Projects/homebrew-tap/Casks/codexbar.rb - formula:
~/Projects/homebrew-tap/Formula/codexbar.rb - CLI release workflow:
.github/workflows/release-cli.yml
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 142 lines · 27 tokens per session scan A f2a3699e1888
release-codexbar is a skill published in the GitHub repository steipete/CodexBar (20,730 stars, last pushed 3d ago), licensed MIT. It adds 27 tokens to every session and 1,574 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
release-peekaboo
Peekaboo release: notarization, npm/GitHub release, appcast, verify, closeout.
cut-release
Cut a new TMDb release — work out the next SemVer version from the evidence, do the pre-tag housekeeping a tag would otherwise freeze in place, draft release notes, then tag and publish the GitHub release. Presents the version (with its reasoning) and the full notes for approval and STOPS; nothing is tagged or…
release-extension
Package and release the Chrome extension - bump version, zip, publish as a GitHub Release, update web page.
releasing-plugin-versions
Use when releasing a new plugin version, bumping versions, creating git tags, or publishing GitHub releases for this marketplace.
ios-bump-version
Skill "ios-bump-version" from CH3COOH/claude-skills, covering bump version スキル, 事前バリデーション, 手順, step 1: 現在の状態を確認 and step 2: フィーチャーブランチを作成.
git-workflow-and-versioning
Structures git workflow practices. Use when making any code change. Use when committing, branching, resolving conflicts, opening or reviewing a pull request (PR), pushing to a remote, or when you need to organize work across multiple parallel streams. Use when cutting a release, choosing a semantic version bump…