agentmods.dev

publish-vscode-extension

publish-vscode-extension is a skill for Claude Code, Codex from TypeFox/agent-skills. It costs 107 tokens per session (4,055 once invoked), scanned A, original, MIT.

A guide for releasing a Visual Studio Code extension through the VS Code Marketplace, Microsoft’s extension directory, and Open VSX, an alternative directory used by many non-Microsoft editors.

In plain words
What is it for?
Auditing the extension manifest and listing, preparing a .vsix package, configuring the vsce or ovsx publishing tools, and publishing to one or both registries.
Why use it?
It helps developers prepare the extension listing and release files correctly and avoid leaving users of non-Microsoft editors without access.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is vsce publish --packagePath ./pkgs/*.vsix.

not rated 5repo today A scan 107 tokens original MIT

Good fit Auditing the extension manifest and listing, preparing a .vsix package, configuring the vsce or ovsx publishing tools, and publishing to one or both registries.

Compare 6 skills from other repositories ↓
View source ↗ TypeFox/agent-skills
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/TypeFox/agent-skills
agentmods
npx agentmods add skills/typefox/agent-skills/publish-vscode-extension

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for publish-vscode-extension

README.md
[![agentmods](https://agentmods.dev/badge/skills/typefox/agent-skills/publish-vscode-extension/github.svg)](https://agentmods.dev/skills/typefox/agent-skills/publish-vscode-extension)
Your own site
<a href="https://agentmods.dev/skills/typefox/agent-skills/publish-vscode-extension"><img src="https://agentmods.dev/badge/skills/typefox/agent-skills/publish-vscode-extension/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for publish-vscode-extension

Your own site · 80×15
<a href="https://agentmods.dev/skills/typefox/agent-skills/publish-vscode-extension"><img src="https://agentmods.dev/badge/skills/typefox/agent-skills/publish-vscode-extension.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 107 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,055 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00107 $0.04055
Opus 5 $0.00053 $0.02027
Sonnet 5 $0.00021 $0.00811
Haiku 4.5 $0.00011 $0.00405

Measured 9d ago against content hash dff17b098214, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

publish-vscode-extension scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/publish-vscode-extension/SKILL.md · 255 lines

How it starts

The opening of the file, as written. The whole thing — 255 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Publish a VS Code extension

There are two registries where VS Code extensions live:

  • VS Code Marketplace — Microsoft's registry. Consumed by VS Code, Visual Studio, and Azure DevOps. Authenticated with an Azure DevOps Personal Access Token (PAT). Tooling: @vscode/vsce.
  • Open VSX Registry — the Eclipse Foundation's open-source registry at https://open-vsx.org. Consumed by VS Codium, Gitpod, Theia-based IDEs, Cursor, Windsurf, code-server, and most non-Microsoft forks. Authenticated with a token issued by open-vsx.org after accepting the Eclipse Publisher Agreement. Tooling: ovsx.

Most production extensions publish to both. The same .vsix works on either registry — package once, publish twice. Don't publish only to Marketplace; non-Microsoft VS Code distributions can't see those extensions.

Branches

Match the user's intent — most sessions are prepare, not publish:

  • Prepare or audit — manifest, README, CHANGELOG, bundling, registry identity, CI workflow. Work only the relevant sections below; do not run publish commands or ask for tokens unless the user asks to publish.
  • Publish now — only when the user wants an agent-driven or one-off publish in this session. Prefer CI (see Typical CI release flow); local vsce/ovsx is the exception.

Publish sequence (publish-now only)

Follow in order; do not skip ahead until each step's done when is met:

  1. Decide registries — default both unless proprietary Marketplace-only APIs block Open VSX. Done when: you've told the user which registries you're targeting.
  2. Prepare — manifest, supporting files, build deps. Done when: required manifest fields and README/LICENSE/CHANGELOG are in place (see below).
  3. Package — vsce package, then inspect with vsce ls. Done when: <name>-<version>.vsix exists and the file list has no src/, .git/, or full node_modules/ tree.
  4. Confirm tokens — env vars for each target registry; never use values pasted in chat. Done when: needed vars are set in this shell (check with [ -n "$VSCE_PAT" ] / [ -n "$OVSX_PAT" ] without printing values) and the user has publisher/namespace identity on each registry (ask before minting tokens if unknown).
  5. Publish — upload that same .vsix to each registry. Done when: every target vsce publish --packagePath … / ovsx publish … exits 0.

Read the full file on GitHub · 255 lines

Files

What ships with it

11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 255 lines · 107 tokens per session scan A dff17b098214

Subscribe to this mod's changes

publish-vscode-extension is a skill published in the GitHub repository TypeFox/agent-skills (5 stars, last pushed today), licensed MIT. It adds 107 tokens to every session and 4,055 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Git and workflowReleases
Related

Other skills, from other repositories

release-announcement

Write a release announcement — changelog, blog post, in-app note, or social post — that leads with user impact, names the audience, and includes upgrade/migration steps without filler.

paperclipai/paperclip · 42 tokens

multi-agent-release-manager

Cleans up the workspace, formats code, runs presubmit checks, and uploads CLs to Gerrit.

chromium/chromium · 27 tokens

release-notes

Generate user-facing release notes from tickets, PRDs, or changelogs. Creates clear, engaging summaries organized by category (new features, improvements, fixes). Use when writing release notes, creating changelogs, announcing product updates, or summarizing what shipped.

phuryn/pm-skills · 57 tokens

pack-submit

Package one of this agent's own skills as a standalone community pack and submit it to the aeon registry as a PR.

aeonfun/aeon · 27 tokens

nvca-chart-release

Release NVCA Operator chart changes from the native monorepo source to the vendored Helm chart. Use when updating the vendored NVCA Operator chart, changing NVCA image refs, publishing helm-nvca-operator, or validating the chart against a self-managed control plane.

NVIDIA/nvcf · 61 tokens

updater_guide

Guidance for checking for and installing Row-Bot updates.

siddsachar/row-bot · 17 tokens