Octop is a self-hosted, multi-user AI assistant that runs multiple specialized agents and connects them to chat interfaces, tools, and external services. It is for individuals, families, and teams who want a locally operated assistant with shared experts and persistent capabilities. Catalogue add-ons extend its agent and assistant workflows.
Borrowing it
Nothing to install: this file belongs to TencentCloud/Octop. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/TencentCloud/Octop/main/.cursor/skills/publish/SKILL.mdgit clone --depth 1 https://github.com/TencentCloud/OctopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tencentcloud/octop/publish)<a href="https://agentmods.dev/skills/tencentcloud/octop/publish"><img src="https://agentmods.dev/badge/skills/tencentcloud/octop/publish.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 19 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.03289 |
| Opus 5 | $0.00037 | $0.01644 |
| Sonnet 5 | $0.00015 | $0.00658 |
| Haiku 4.5 | $0.00007 | $0.00329 |
Grade A, and why
publish scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 321 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Publish
自动化 Octop Python 包的完整发布流程。
开始时宣告： "正在使用 publish 技能发布版本 {VERSION}。"
配置项
以下配置有默认值，可在项目的 .cursor/skills/publish/SKILL.md 中覆盖。
| 配置项 | 默认值 | 说明 |
|---|---|---|
CHANGELOG_FILE |
CHANGELOG.md |
相对于仓库根目录的路径，文件不存在则跳过 |
VERSION_FILE |
pyproject.toml |
包含版本号的文件 |
VERSION_PATTERN |
^\s*version\s*=\s*"[^"]+" |
匹配版本行的正则表达式 |
README_FILE |
README.md |
含 shields.io 版本徽标的文件（badge 版本号同步升级） |
INIT_VERSION_FILE |
src/octop/__init__.py |
含运行时常量 __version__ 的文件（缺失则跳过并提示） |
TAG_PREFIX |
v |
Git tag 前缀；工作流监听 v*，生成 v0.1.14 风格标签 |
REMOTE |
origin |
Git 远程仓库名 |
INTEGRATION_BRANCH |
develop |
日常集成分支；release 必须从最新 tip 切出 |
TARGET_BRANCH |
main |
合并请求的目标分支（生产真源） |
RELEASE_BRANCH_PREFIX |
release/ |
release 分支名前缀 |
调用方式
/publish 0.1.14
目标版本号是唯一必填参数，其余均从配置或自动检测获取。
发布流程
顺序硬约束： 先 PR 合入
main，再在 main tip 打并推送v*tag。
禁止在 release 分支未合入main前推送生产 tag。
步骤 1 — 读取配置并确认版本
- 获取仓库根目录：
git rev-parse --show-toplevel - 记录当前分支为
{original_branch}。 git fetch {REMOTE} {INTEGRATION_BRANCH} {TARGET_BRANCH}- 从
VERSION_FILE读取当前版本（在即将基于的 integration tip 上）：git show {REMOTE}/{INTEGRATION_BRANCH}:pyproject.toml | grep -E '^\s*version\s*=\s*"[^"]+"' - 检查未提交的更改：
若工作树不干净：中止并要求用户先提交或 stash。发布不得夹带无关脏文件。git status --short - 查找最近的 git tag：
如果没有 tag，视为首次发布（在步骤 3 中使用从仓库初始到 HEAD 的所有提交）。git tag --sort=-creatordate | head -1 - 展示确认信息：
当前版本 (pyproject.toml @ develop): X.Y.Z
目标版本: A.B.C
上次发布 tag: vX.Y.Z (YYYY-MM-DD)
Release 分支: release/A.B.C
集成起点: develop
合入目标: main
Tag 时机: main 合并之后（不会在 release 上先打 tag）
确认发布 X.Y.Z → A.B.C？[y/N]
如果用户未输入 y 确认，立即中止。
步骤 2 — 从 develop 创建 release 分支
git checkout -B {RELEASE_BRANCH_PREFIX}{version} {REMOTE}/{INTEGRATION_BRANCH}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +3 tokens per session b6198a2c56d6
- 8d ago First seen · 321 lines · 71 tokens per session scan A 380741ea79ec
publish is a skill published in the GitHub repository TencentCloud/Octop (1,501 stars, last pushed today), licensed MIT. It adds 74 tokens to every session and 3,289 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
github-release-management
Comprehensive GitHub release orchestration with AI swarm coordination for automated versioning, testing, deployment, and rollback management.
agent-github-modes
Agent skill for github-modes - invoke with $agent-github-modes.
release-cut
Cut a new pi-agent-dashboard release: promote ## [Unreleased] in CHANGELOG.md, bump every workspace package.json per SemVer, commit, tag v , and push — triggering the Release workflow that publishes every non-private workspace, builds the Electron artifacts, and creates a GitHub Release. Use on "cut a release"…
public-plugin-packaging
Use when packaging an Agentlas agent repo for public GitHub release, Codex plugin submission, Claude adapter distribution, or one-line terminal installation.
release-revoke
Revoke or rollback a pi-agent-dashboard release: delete the GitHub Release, remove the git tag locally and on origin, deprecate the npm version (npm unpublish is blocked after 72h), and optionally revert the release commit. Use when the user says "revoke release", "rollback release", "delete release", "unpublish…
release-readiness-check
Verify all prerequisites are met before a release by checking PRs, CI/CD status, environment health, and blocking issues across GitHub, ArgoCD, and Jira. Use before cutting a release, deploying to production, or during release planning.