What is release-hygiene?

A release-maintenance workflow for passkey-mcp. It applies Semantic Versioning, updates release notes, and keeps the project version files and lock file aligned.

It helps finish feature branches and pull requests by updating CHANGELOG.md, pyproject.toml, passkey/init.py, and uv.lock.

It prevents a branch or pull request from having missing changelog entries or mismatched version numbers.

How TheNickSanchez/passkey-mcp configures Cursor

Reuse

Borrowing it

Nothing to install: this file belongs to TheNickSanchez/passkey-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/TheNickSanchez/passkey-mcp/main/.cursor/skills/release-hygiene/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/TheNickSanchez/passkey-mcp

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/thenicksanchez/passkey-mcp/release-hygiene/github.svg)](https://agentmods.dev/skills/thenicksanchez/passkey-mcp/release-hygiene)

Your own site

<a href="https://agentmods.dev/skills/thenicksanchez/passkey-mcp/release-hygiene"><img src="https://agentmods.dev/badge/skills/thenicksanchez/passkey-mcp/release-hygiene/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/thenicksanchez/passkey-mcp/release-hygiene"><img src="https://agentmods.dev/badge/skills/thenicksanchez/passkey-mcp/release-hygiene.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 78 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 536 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00078	$0.00536
Opus 5.5	$0.00031	$0.00214
Sonnet 5.5	$0.00016	$0.00107
Haiku 4.5	$0.00008	$0.00054

Measured 1mo ago against content hash 8c674693dfb1, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

release-hygiene scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/skills/release-hygiene/SKILL.md · 35 lines

What it actually says

Release hygiene

Every merge to main must include a changelog bullet and a version bump. The sys-release agent owns this; follow the same rules if you are the parent agent.

Classify (0.x)

patch — bugfix, tests, CI, docs, chore, behavior-neutral refactor
minor — new CLI/MCP behavior, or a breaking change while still 0.x
major — 1.0.0 only (do not use)

First published tag is 0.4.0 (PLAN.md D2). Until that PR, bump 0.3.x.

Edit

Ensure ## [Unreleased] exists at the top of CHANGELOG.md. Put this PR’s one-sentence bullets there (Added / Changed / Fixed / Security).
Promote the previous version. If [Unreleased] still holds notes for the version now on main, move them to ## 0.3.N (YYYY-MM-DD) below [Unreleased]. Do not leave two versions mixed under [Unreleased]. This is not the same as creating ## 0.4.0.
Bump [project] version in pyproject.toml only. passkey --version reads importlib.metadata.version("passkey-mcp") — do not re-add a hardcoded string in passkey/__init__.py. Bump uv.lock’s passkey-mcp version to match (uv lock or the smallest edit; do not bump dependencies unless this PR is about them).
If CHANGELOG still lists 0.3.0 known issues that the rewrite fixed, delete those lines when you touch the file.

Do not

Tag, twine upload, or move [Unreleased] into ## 0.4.0 except on the D2 release PR.

If CHANGELOG.md is unchanged vs main, the Cursor hook will deny git push and gh pr create.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed · -1 lines · -8 tokens per session 8c674693dfb1
1mo ago First seen · 36 lines · 86 tokens per session scan A aa87302d9e29

Subscribe to this mod's changes

release-hygiene is a skill published in the GitHub repository TheNickSanchez/passkey-mcp (0 stars, last pushed yesterday), licensed MIT. It adds 78 tokens to every session and 536 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-13.

Git and workflow Releases

release-announcement

Write a release announcement — changelog, blog post, in-app note, or social post — that leads with user impact, names the audience, and includes upgrade/migration steps without filler.

paperclipai/paperclip · 42 tokens

release

Fully automate a release with version-bump and childhood.

thedotmack/claude-mem · 13 tokens

release-notes

Generate user-facing release notes from tickets, PRDs, or changelogs. Creates clear, engaging summaries organized by category (new features, improvements, fixes). Use when writing release notes, creating changelogs, announcing product updates, or summarizing what shipped.

phuryn/pm-skills · 57 tokens

passkey-mcp: Skill for Cursor