Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/tobi/qmd/releasenpx skills add tobi/qmd --skill releasegit clone --depth 1 https://github.com/tobi/qmdWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00058 | $0.01368 |
| Opus 5 | $0.00029 | $0.00684 |
| Sonnet 5 | $0.00012 | $0.00274 |
| Haiku 4.5 | $0.00006 | $0.00137 |
Grade A, and why
release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Release
Cut a release, validate the changelog, and ensure git hooks are installed.
Usage
/release 1.0.5 or /release patch (bumps patch from current version).
Process
When the user triggers /release <version>:
-
Gather context — run
skills/release/scripts/release-context.sh <version>. This silently installs git hooks and prints everything needed: version info, working directory status, commits since last release, files changed, current[Unreleased]content, and the previous release entry for style reference. -
Commit outstanding work — if the context shows staged, modified, or untracked files that belong in this release, commit them first. Use the /commit skill or make well-formed commits directly.
-
Write the changelog — if
[Unreleased]is empty, write it now using the commits and file changes from the context output. Follow the changelog standard below. Re-run the context script after committing if needed. -
Check dependency updates — before cutting the release, check for updates to
sqlite-vec(and platform packages),node-llama-cpp, andbetter-sqlite3. Runpnpm outdatedand report any available updates for these packages. If updates exist, bump them (pinned, no^ranges) and re-run tests before proceeding. -
Cut the release — run
scripts/release.sh <version>. This renames[Unreleased]→[X.Y.Z] - date, inserts a fresh[Unreleased], bumpspackage.jsonand the plugin version in.claude-plugin/marketplace.json(so installed plugins see the update), commits, and tags. -
Show the final changelog — print the full
[Unreleased]+ minor series rollup viascripts/extract-changelog.sh <version>. Ask the user to confirm before pushing. -
Push — after explicit confirmation, run
git push origin main --tags. -
Watch CI — after the push, start a background dispatch to watch the publish workflow. Use
interactive_shellin dispatch mode with:gh run watch $(gh run list --workflow=publish.yml --limit=1 --json databaseId --jq '.[0].databaseId') --exit-statusThe agent will be notified when CI completes and should report the result.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 142 lines · 58 tokens per session scan A dbc94e782428
release is a skill published in the GitHub repository tobi/qmd (29,423 stars, last pushed 14d ago), licensed MIT. It adds 58 tokens to every session and 1,368 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
prepare-providers-documentation
Replace the manual commit-by-commit classification step in breeze release-management prepare-provider-documentation with AI-driven classification. For each provider with pending changes, analyze every PR (batched into one sub-agent per provider, not one per PR), pay special attention to potentially breaking changes by…
land-and-deploy
Land and deploy workflow. (gstack).
landing-report
Read-only queue dashboard for workspace-aware ship. (gstack).
flutter-cherry-pick
How to land a formal cherry-pick of a merged PR for the flutter/flutter repo stable or beta channel. Only use for flutter/flutter landed pull requests. Only use when the cherry pick request is into "stable", "beta" or a branch that has the format with flutter- . -candidate.0.
version-bump
Automated semantic versioning and release workflow for Claude Code plugins. Handles version increments across package.json, marketplace.json, plugin.json manifests, build verification, git tagging, GitHub releases, and changelog generation. NPM publishing is the final human-required handoff because the maintainer…
release-changelog
Generate the stable Paperclip release changelog at releases/vYYYY.MDD.P.md by reading commits, changesets, and merged PR context since the last stable tag.