agentmods.dev

publish-vscode-extension

publish-vscode-extension is a skill for Claude Code from TypeFox/agent-skills. It costs 107 tokens per session (4,052 once invoked), scanned A, original, MIT.

A guide for releasing a Visual Studio Code extension through the VS Code Marketplace, Microsoft’s extension directory, and Open VSX, an alternative directory used by many non-Microsoft editors.

In plain words
What is it for?
Auditing the extension manifest and listing, preparing a .vsix package, configuring the vsce or ovsx publishing tools, and publishing to one or both registries.
Why use it?
It helps developers prepare the extension listing and release files correctly and avoid leaving users of non-Microsoft editors without access.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is vsce publish --packagePath ./pkgs/*.vsix.

Part of the typefox-agent-skills plugin — 11 skills shipped together

not rated 5repo changed 18d ago A scan 107 tokens original MIT

Good fit Auditing the extension manifest and listing, preparing a .vsix package, configuring the vsce or ovsx publishing tools, and publishing to one or both registries.

Compare 6 skills from other repositories ↓
View source ↗ TypeFox/agent-skills typefox.dev
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/TypeFox/agent-skills
agentmods
npx agentmods add skills/typefox/agent-skills/publish-vscode-extension

Made for: Claude Code.

Or install typefox-agent-skills, the plugin that ships this one along with the rest of its 11 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for publish-vscode-extension

README.md
[![agentmods](https://agentmods.dev/badge/skills/typefox/agent-skills/publish-vscode-extension/github.svg)](https://agentmods.dev/skills/typefox/agent-skills/publish-vscode-extension)
Your own site
<a href="https://agentmods.dev/skills/typefox/agent-skills/publish-vscode-extension"><img src="https://agentmods.dev/badge/skills/typefox/agent-skills/publish-vscode-extension/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for publish-vscode-extension

Your own site · 80×15
<a href="https://agentmods.dev/skills/typefox/agent-skills/publish-vscode-extension"><img src="https://agentmods.dev/badge/skills/typefox/agent-skills/publish-vscode-extension.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 107 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,052 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00107 $0.04052
Opus 5.5 $0.00043 $0.01621
Sonnet 5.5 $0.00021 $0.00810
Haiku 4.5 $0.00011 $0.00405

Measured 18d ago against content hash 3347b7ffed0c, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

publish-vscode-extension scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/publish-vscode-extension/SKILL.md · 255 lines

How it starts

The opening of the file, as written. The whole thing — 255 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Publish a VS Code extension

There are two registries where VS Code extensions live:

  • VS Code Marketplace — Microsoft's registry. Consumed by VS Code, Visual Studio, and Azure DevOps. Authenticated with an Azure DevOps Personal Access Token (PAT). Tooling: @vscode/vsce.
  • Open VSX Registry — the Eclipse Foundation's open-source registry at https://open-vsx.org. Consumed by VS Codium, Theia-based IDEs, Cursor, Windsurf, code-server, and most non-Microsoft forks. Authenticated with a token issued by open-vsx.org after accepting the Eclipse Publisher Agreement. Tooling: ovsx.

Most production extensions publish to both. The same .vsix works on either registry — package once, publish twice. Don't publish only to Marketplace; non-Microsoft VS Code distributions can't see those extensions.

Branches

Match the user's intent — most sessions are prepare, not publish:

  • Prepare or audit — manifest, README, CHANGELOG, bundling, registry identity, CI workflow. Work only the relevant sections below; do not run publish commands or ask for tokens unless the user asks to publish.
  • Publish now — only when the user wants an agent-driven or one-off publish in this session. Prefer CI (see Typical CI release flow); local vsce/ovsx is the exception.

Publish sequence (publish-now only)

Follow in order; do not skip ahead until each step's done when is met:

  1. Decide registries — default both unless proprietary Marketplace-only APIs block Open VSX. Done when: you've told the user which registries you're targeting.
  2. Prepare — manifest, supporting files, build deps. Done when: required manifest fields and README/LICENSE/CHANGELOG are in place (see below).
  3. Package — vsce package, then inspect with vsce ls. Done when: <name>-<version>.vsix exists and the file list has no src/, .git/, or full node_modules/ tree.
  4. Confirm tokens — env vars for each target registry; never use values pasted in chat. Done when: needed vars are set in this shell (check with [ -n "$VSCE_PAT" ] / [ -n "$OVSX_PAT" ] without printing values) and the user has publisher/namespace identity on each registry (ask before minting tokens if unknown).
  5. Publish — upload that same .vsix to each registry. Done when: every target vsce publish --packagePath … / ovsx publish … exits 0.

Read the full file on GitHub · 255 lines

Files

What ships with it

11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 18d ago Changed 3347b7ffed0c
  2. 1mo ago First seen · 255 lines · 107 tokens per session scan A dff17b098214

Subscribe to this mod's changes

publish-vscode-extension is a skill published in the GitHub repository TypeFox/agent-skills (5 stars, last pushed 2d ago), licensed MIT. It adds 107 tokens to every session and 4,052 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Git and workflowReleasesagentic-codingagentic-workflowsagentsskills
Related

Other skills, from other repositories

Release Engineering

Semantic versioning, changelog generation, and release/hotfix management so releases are predictable and reversible.

niels-emmer/myace · 24 tokens

merge

The ship gate — the only skill that pushes a feature branch, opens its PR and merges. --staging checks that pre-merge passed on the branch tip, pushes, opens the feature→staging PR, waits for green CI, merges, deploys, verifies, emits a human test script and stamps the staging sign-off on approval. --production ships…

ndisisnd/msg · 126 tokens

loom-plan-writer

REQUIRED skill for creating Loom execution plans.

cosmix/loom · 14 tokens

loom-git-workflow

Git operations guidance including branching strategies, commit conventions, merge workflows, conflict resolution, and worktree management.

cosmix/loom · 27 tokens

capgo-release-management

Runs Capgo OTA release operations with the CLI, including bundle upload (channels, delta, rollout, encryption, version bumps), bundle compatibility and releaseType checks, channel add/set/promote/currentBundle/delete, progressive rollouts and rollback, bundle cleanup, preview QR codes, and key create/save encryption…

Cap-go/capgo-skills · 162 tokens

zb-release-pipeline

Generate a GitHub Actions pipeline that builds a zb (Zero Dependencies Builder) project and publishes a GitHub Release with the produced JAR. Use whenever the user wants CI/CD, a build pipeline, a release workflow, or GitHub Actions for a zb-based Java project — phrases like "set up GitHub Actions for this zb…

AdamBien/airails · 148 tokens