Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/syndicalt/zaxy/releasenpx skills add syndicalt/zaxy --skill releasegit clone --depth 1 https://github.com/syndicalt/zaxyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/syndicalt/zaxy/release)<a href="https://agentmods.dev/skills/syndicalt/zaxy/release"><img src="https://agentmods.dev/badge/skills/syndicalt/zaxy/release.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00084 | $0.01189 |
| Opus 5 | $0.00042 | $0.00594 |
| Sonnet 5 | $0.00017 | $0.00238 |
| Haiku 4.5 | $0.00008 | $0.00119 |
Grade C, and why
release scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -s https://pypi.org/pypi/zaxy-memory/X.Y.Z/json | python -c "import sys,json;print(json.load(sys.stdin)['info']['version'])" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s https://pypi.org/pypi/zaxy-memory/X.Y.Z/json | python -c "import sys,json;print(json.load(sys.stdin)['info']['version'])" How it starts
The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Release zaxy-memory
Publishing is irreversible. Two hard gates in this flow require an explicit user go: creating the GitHub Release (step 7) is the only one that publishes.
0. Decide the version
Patch = fixes only. Minor = features/CLI surface changes. Any Breaking entry
(even a disclosed one) still fits minor pre-1.0-style per this repo's history
(3.1.0 broke export). Confirm choice with the user if mixed.
1. Preflight
cd <repo> && git checkout master && git pull -q origin master
git status --porcelain --untracked-files=no # must be empty
git log --oneline -3
- Working tree must be clean. Untracked scratch (reports dirs, .claude/) stays out.
- Identify what's shipping:
git log v<PREV>..HEAD --oneline.
2. Bump the version — THREE fields, not one
grep -n '<OLD_VERSION>' pyproject.toml server.json
Edit all of:
pyproject.toml→version = "X.Y.Z"server.jsontop-level"version"server.json→packages[0].version← the one that historically gets missed
Re-grep for the old version in both files; zero hits or you're not done.
3. CHANGELOG
Add/finalize ## X.Y.Z - YYYY-MM-DD at the top (rename ## Unreleased if present).
Keep-a-Changelog categories (### Added/Changed/Deprecated/Breaking/Fixed),
bold-lead bullets, candid tone. Breaking changes get a migration line.
4. Release PR
git checkout -b release/X.Y.Z
git add pyproject.toml server.json CHANGELOG.md
git commit # "release: X.Y.Z — <em-dash summary>" + body + Co-Authored-By trailer
git push -u origin release/X.Y.Z
gh pr create --base master --title "release: X.Y.Z — <summary>" --body "<what it bundles>"
gh pr checks <N> --watch --interval 30
All checks must pass. If coverage fails see the ci-triage skill — never lower the floor.
5. Merge (rebase, never squash)
gh pr merge <N> --rebase --delete-branch
git checkout master && git pull -q origin master
6. Verify master CI on the EXACT merged tip
CI runs are per-SHA — a green "latest" may be the previous tip.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 115 lines · 84 tokens per session scan C de9acccd3921
release is a skill published in the GitHub repository syndicalt/zaxy (17 stars, last pushed 24d ago), licensed MIT. It adds 84 tokens to every session and 1,189 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
prepare-release
End-to-end release automation — reads commits since last tag, infers semver bump, drafts changelog, creates release PR, merges it, waits for CI green, tags, and monitors the Docker build to completion. Use when the user says: prepare release, cut a release, bump version, create release PR, ship a new version, tag a…
release
Use when the user asks to cut, tag, or ship an openings-mcp release (e.g. "release v0.8.0"), to run pre-release provider smoke tests, or to rewrite a fresh release's auto-generated notes.
c-12-closeout
Close out approved Agents Remember edits by preserving approval authority, mandatory strict code quality before code commit, missing-onboarding checks, external-memory refresh, memory quality, ledger alignment, and no automatic push.
release
Cut a new kotlin-lib-mcp release — bump the version in both tag-guarded files consistently, update the changelog, run the pre-flight checks, and (on request) tag. Use when preparing a release or when a release tag failed the version-match guard.
release
Release vercel-plugin — run gates, bump version, generate artifacts, commit, and push. Use when asked to "release", "ship", "bump and push", or "cut a release".
ship-cycle
Issue-driven development orchestrator. Turns improvement intent into a well-specified, bilingual issue set; clusters issues into milestones that map 1:1 to semver versions; enforces branch, commit, and PR conventions (GitHub Flow — / - , Conventional Commits, mandatory PR template, rebase-first merge); generates…