Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wan-huiyan/claude-ecosystem-hygiene --skill claude-plugin-repo-ci-releasegit clone --depth 1 https://github.com/wan-huiyan/claude-ecosystem-hygieneWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wan-huiyan/claude-ecosystem-hygiene/claude-plugin-repo-ci-release)<a href="https://agentmods.dev/skills/wan-huiyan/claude-ecosystem-hygiene/claude-plugin-repo-ci-release"><img src="https://agentmods.dev/badge/skills/wan-huiyan/claude-ecosystem-hygiene/claude-plugin-repo-ci-release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wan-huiyan/claude-ecosystem-hygiene/claude-plugin-repo-ci-release"><img src="https://agentmods.dev/badge/skills/wan-huiyan/claude-ecosystem-hygiene/claude-plugin-repo-ci-release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00308 | $0.02357 |
| Opus 5 | $0.00154 | $0.01179 |
| Sonnet 5 | $0.00062 | $0.00471 |
| Haiku 4.5 | $0.00031 | $0.00236 |
Grade A, and why
claude-plugin-repo-ci-release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 183 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Claude Plugin Repo CI + Release Automation
Claude Code plugin/marketplace repos rot in two predictable ways, and this skill installs the two small guards that stop both:
-
No CI. A typo in
marketplace.json, a plugin dir whoseplugin.jsonnamedoesn't match its folder, an orphaned plugin not registered in the marketplace, or aSKILL.mdwhose frontmattername:disagrees with its directory — any of these silently breaks plugin installation, and nobody notices until a user tries to install. A fast structural validator on every PR catches them at review time. -
Releases drift behind. Versions live in
plugin.json/marketplace.json/ README, but GitHub Releases are cut by hand — so they fall behind. (Seen in the wild: a skill shipped at v3.3.0 while its GitHub Release sat at v2.0.0 for weeks.) A workflow that cuts the release automatically when aVERSIONfile changes keeps them in lockstep.
The whole thing is two workflow files, one validator script, and a one-line VERSION
file. Bundled and ready to copy — you should rarely need to write any of it from scratch.
What's bundled
scripts/validate_plugins.py— stdlib-only structural validator (no pip installs). Handles both repo layouts. Copy to.github/scripts/validate_plugins.py.assets/ci.yml— runs the validator on every PR + push to main. Copy to.github/workflows/ci.yml.assets/release.yml— release-on-version-bump. Copy to.github/workflows/release.yml.
The two repo layouts
The validator and workflows handle both — you don't pick one, the validator auto-detects:
- Multi-plugin bundle (e.g. an ecosystem marketplace):
plugins/<name>/SKILL.mdplugins/<name>/.claude-plugin/plugin.json, one marketplace entry per plugin.
- Single multi-skill plugin (e.g. a lesson collection): one
plugins/<the-plugin>/whose skills live nested underplugins/<the-plugin>/skills/<skill>/SKILL.md. The marketplace has a single entry.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 183 lines · 308 tokens per session scan A 0f9b64c4fc1f
claude-plugin-repo-ci-release is a skill published in the GitHub repository wan-huiyan/claude-ecosystem-hygiene (1 stars, last pushed 26d ago), licensed MIT. It adds 308 tokens to every session and 2,357 once invoked, about $0.0015 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
merge-queue-thrash-stop-inflow-and-open-prs-as-drafts
When main moves faster than the slowest CI leg, every open branch goes stale before it can merge and the whole queue jams with nothing red. Use when: (1) several PRs sit at mergeStateStatus BEHIND with auto-merge armed and none of them lands; (2) branches are being updated, re-running CI and going stale again before…
abd-devops
ABD DevOps agent: scaffolds CI/CD, validates .env.example coverage, checks Dockerfile hygiene, and handles release tasks.
push-ci
Push to remote and monitor CI. Validates branch safety, executes git push WITH explicit user approval, then monitors CI run status via gh CLI. Use when: user says 'push', 'push and watch CI', 'ship it', 'push-ci'. Not for: committing (use /smart-commit), creating PRs (use /create-pr), merging (use /merge-prep).
cloudflare-workers-ci-cd
Complete CI/CD guide for Cloudflare Workers using GitHub Actions and GitLab CI. Use for automated testing, deployment pipelines, preview environments, secrets management, or encountering deployment failures, workflow errors, environment configuration issues.
ops-ship
OPS on-demand: This skill should be used when the user asks to "ship ops plugin", "merge all PRs and…
version-bump
This skill automates version bumping during the release process for the Claude Code Handbook monorepo. It should be used when the user requests to bump versions, prepare a release, or increment version numbers across the repository.