Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add stephansama/packages --skill multipublishgit clone --depth 1 https://github.com/stephansama/packagesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/stephansama/packages/multipublish)<a href="https://agentmods.dev/skills/stephansama/packages/multipublish"><img src="https://agentmods.dev/badge/skills/stephansama/packages/multipublish/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/stephansama/packages/multipublish"><img src="https://agentmods.dev/badge/skills/stephansama/packages/multipublish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.01243 |
| Opus 5.5 | $0.00033 | $0.00497 |
| Sonnet 5.5 | $0.00017 | $0.00249 |
| Haiku 4.5 | $0.00008 | $0.00124 |
Grade A, and why
multipublish scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 185 lines — stays where its author put it; the contents beside it link to each section on GitHub.
multipublish
Publishes monorepo packages to multiple registries in a single step. Reads released package info from changesets and loops over configured platforms.
Setup
{
"$schema": "./node_modules/@stephansama/multipublish/config/schema.json",
"platforms": [
["jsr", { "experimentalGenerateJSR": true }],
["npm", { "tokenEnvironmentKey": "NODE_AUTH_TOKEN" }]
]
}
Place as .multipublishrc.json, .config/multipublishrc.json, or a multipublish key in package.json. See cosmiconfig docs for all supported filenames.
Core Patterns
Changeset-based release (GitHub Actions)
- name: Create Changeset Release
uses: changesets/action@v1
id: changesets
with:
publish: pnpm run publish
- name: Publish to other registries
if: steps.changesets.outputs.published == 'true'
run: echo "${{ steps.changesets.outputs.publishedPackages }}" | multipublish
changeset publish output is piped into multipublish via stdin. The JSON array of published packages tells multipublish which packages to process and at which versions.
Use --useChangesetStatus instead of stdin
{
"scripts": {
"preversion": "multipublish --useChangesetStatus --versionJsr",
"version": "changeset version"
}
}
--useChangesetStatus reads which packages have pending (unreleased) changesets directly from the changeset state — without piping from changeset publish. Use it in preversion to update JSR config versions before the changeset version bump runs.
GitHub npm registry with scoped token
{
"platforms": [
[
"npm",
{
"registry": "https://npm.pkg.github.com",
"tokenEnvironmentKey": "GITHUB_TOKEN"
}
]
]
}
Set packages: write permission in the GitHub Actions workflow.
Dry run
multipublish --dry
Runs the full flow but passes --dry-run to the underlying publish commands. Use to verify config without publishing.
Common Mistakes
CRITICAL No jsr.json/deno.json and experimentalGenerateJSR not enabled
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 185 lines · 83 tokens per session scan A ba2938318d80
multipublish is a skill published in the GitHub repository stephansama/packages (5 stars, last pushed yesterday), licensed MIT. It adds 83 tokens to every session and 1,243 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
draft-release-notes
Author the committed release-notes file for a Prisma 8 release (stable or 8.0.0-rc.N) by enumerating the merged PRs since the previous release v tag (stable or -rc.N), resolving opaque TML-NNNN: titles via Linear context (never copied verbatim), triaging public-worthiness, and writing categorized notes — breaking…
publish-npm-version
Cuts the next release of Prisma 8: bumps the root package.json version (on the v8 RC line: 8.0.0-rc.N → rc.N+1), propagates it to every workspace package, and opens a PR titled "chore(release): bump to ". When the maintainer merges the PR, the Publish to npm workflow runs automatically and ships the new version to npm…
playground-snapshot-release
Publish a Playground UI snapshot (@mastra/playground-ui and its workspace dependencies) from main or the current branch via the playground-snapshot mode of the Publish to npm workflow, wait for it to finish, then open a PR on mastra-ai/platform bumping the frontend to the published snapshot version. Use when asked to…
pr-snapshot-release
Guide a Mastra maintainer through publishing an npm snapshot from a pull request or a specified repository branch. Use when asked to release, publish, or create a PR snapshot, branch snapshot, canary package build, or branch-specific npm tag. Performs source and branch preflight checks, requires confirmation before…
plugin-publish
A release guide for publishing Zhin.js plugins to npm, the JavaScript package registry, and to the Zhin plugin marketplace. It covers package metadata, versioning, release checks, and submission requirements.
release-aur
Use when creating, updating, reviewing, or publishing Arch User Repository (AUR) packages. Runs /release-aur plan first, reviews PKGBUILD/.SRCINFO/build/namcap evidence, and only recommends /release-aur publish after a GO decision.