Borrowing it
Nothing to install: this file belongs to WaniWani-AI/sdk. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/WaniWani-AI/sdk/main/.claude/skills/release-migration/SKILL.mdgit clone --depth 1 https://github.com/WaniWani-AI/sdkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/waniwani-ai/sdk/release-migration)<a href="https://agentmods.dev/skills/waniwani-ai/sdk/release-migration"><img src="https://agentmods.dev/badge/skills/waniwani-ai/sdk/release-migration/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/waniwani-ai/sdk/release-migration"><img src="https://agentmods.dev/badge/skills/waniwani-ai/sdk/release-migration.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 28 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
- medium Agent Snooping · line 31 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 69 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium MCP Rug Pull · line 30 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.01330 |
| Opus 5 | $0.00036 | $0.00665 |
| Sonnet 5 | $0.00014 | $0.00266 |
| Haiku 4.5 | $0.00007 | $0.00133 |
Grade A, and why
release-migration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Release migration
@waniwani/sdk is 0.x, so minor bumps can break the public API. The principle behind this skill: a version bump is not finished until a user (or their agent) can upgrade to it without reading the source. Every breaking change ships with a mechanical, agent-applicable migration. This holds at every version boundary — 0.15, 1.0, and 15.0 alike.
Inspired by how the AI SDK ships migrate-* skills for each major: we keep the equivalent baked into the SDK's own docs so upgrading is a one-pass, auto-applied operation.
When to run
- Bumping the version in
package.json - Landing any change to the public API tiers (see CLAUDE.md — OSS / Free tier / Legacy surfaces)
- Preparing changelog / release notes
- Deprecating or removing an exported symbol
If the change is purely internal (no exported symbol, type, or documented behavior changes), no migration is needed — say so and stop.
The rule
A release that breaks the public API must ship all three of these before it is done:
- Changelog entry — a
## <version>:section in the docs changelog (sdk/changelog.mdxin the docs repo, published at docs.waniwani.ai/sdk/changelog) with:- a before/after code snippet, and
- a mechanical migration an agent can apply without judgment (a codemod recipe, not "update your calls").
- Also add a row to the Breaking changes at a glance table.
- A
<Tip>at the top of the section linking the version-specific migration skill (deliverable 2):npx skills add Waniwani-AI/sdk -s migrate-waniwani-sdk-<from>-to-<to>, so a reader can run the migration, not just read it.
- A version-specific migration skill — a self-contained sibling skill
skills/migrate-waniwani-sdk-<from>-to-<to>/SKILL.mdcovering exactly this hop (one skill per version boundary, the way Vercel ships amigrate-*skill per major). It restates every breaking change of the release as a numbered, apply-without-judgment recipe, ends withbun run typecheck && bun testas the completion check, and does not try to handle other version deltas. Copy the newest existingmigrate-waniwani-sdk-*skill as the template. Add a one-line pointer to it fromskills/waniwani-sdk/SKILL.md's upgrade section. - Deprecation shim (where feasible) — keep the old signature/export working behind a
@deprecatedJSDoc that names the removal version. This turns a hard break into a soft one; users get warnings before errors. Not always possible (a surface that never worked is deleted outright, not shimmed).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 75 lines · 71 tokens per session scan A 608aaae389d3
release-migration is a skill published in the GitHub repository WaniWani-AI/sdk (17 stars, last pushed 2d ago), licensed MIT. It adds 71 tokens to every session and 1,330 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
publish-site
Versioned site deploys to GitHub/Cloudflare/Netlify Pages.
batch
Research and plan a large-scale change, then execute it in parallel across 5–30 isolated worktree agents that each open a PR.
github
GitHub via gh CLI: PRs, issues, reviews, repos, auth.
release-jetbrains
Use when releasing the Kilo JetBrains plugin -- resolve a version ("next rc" or explicit), run the prepare workflow, edit and commit a filtered human-readable changelog on the release PR, then watch publish to completion.
git-wrapup
Land working-tree changes as logical commits — the work grouped by concern, topped by a release commit (version bump, changelog, regenerated artifacts) and an annotated tag. Verify, commit, tag. Stops at "committed and tagged locally" — no push, no publish. The release-and-publish skill picks up from here. Distilled…
release-and-publish
Ship a release end-to-end across every registry the project targets (npm, MCP Registry, GitHub Releases for .mcpb bundles, GHCR). Runs the final verification gate, pushes commits and tags, then publishes to each applicable destination. Assumes git wrapup (version bumps, changelog, commit, annotated tag) is already…