Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add willdady/platypus --skill pre-release-checkgit clone --depth 1 https://github.com/willdady/platypusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/willdady/platypus/pre-release-check)<a href="https://agentmods.dev/skills/willdady/platypus/pre-release-check"><img src="https://agentmods.dev/badge/skills/willdady/platypus/pre-release-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/willdady/platypus/pre-release-check"><img src="https://agentmods.dev/badge/skills/willdady/platypus/pre-release-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.03225 |
| Opus 5.5 | $0.00020 | $0.01290 |
| Sonnet 5.5 | $0.00010 | $0.00645 |
| Haiku 4.5 | $0.00005 | $0.00323 |
Grade A, and why
pre-release-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 247 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pre-release check
This is the last thing that runs before a release is cut. Nothing downstream catches what you miss here.
Releases are cut by release-please: a bot PR titled chore(main): release <version>
sits open against main, and the release happens the moment it merges — tagging,
publishing images, and cutting a GitHub release. There is no undo.
Three mechanics shape the whole check:
- The changelog is built only from Conventional Commit subjects on
main. mainsquash-merges with the PR title as the commit subject. A PR titled without afeat/fix/choreprefix lands a commit that contributes nothing to the changelog and nothing to the version bump — a feature ships silently inside a patch release.mainis protected against force-pushes, so a subject that landed wrong cannot be rewritten. It can only be corrected by a follow-up commit.
You end on a verdict: ship or hold. A hedge is a hold. Everything below feeds that one call, so run every step — a skipped step is an unknown, and an unknown holds.
Step 1 — Go green
Confirm the ground first: on main, synced with origin/main, working tree clean.
git fetch --tags && git fetch origin main
git status --short && git log --oneline origin/main..HEAD
Lint, typecheck and tests are not re-run here. CI runs them on every push to main,
so the tip has already been through them — but "CI runs on main" is only a guarantee if
you look at the result. Read it:
git rev-parse origin/main
gh run list --branch main --workflow ci.yml --limit 1 \
--json headSha,status,conclusion,url --jq '.[0]'
The run's headSha must equal origin/main and its conclusion must be success. Three
ways that goes wrong, all holds:
- The newest run is for an older commit. The tip is unverified — most likely it arrived by a push that bypassed the pull request, which is how a security fix lands off a private advisory. Wait for its run, or trigger one.
- No run at all, or one still in progress. Wait for it. An absent result is not a passing one.
- A failing run. Stop here.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed 4db7e695ad4d
- 10d ago Changed · +16 lines 0195a57b2606
- 14d ago Changed c37fe75932cf
- 25d ago Changed · +8 lines ee40758335f0
- 1mo ago Changed · +7 lines 2eb2f1d323f8
- 1mo ago First seen · 216 lines · 51 tokens per session scan A cbdf44f36d58
pre-release-check is a skill published in the GitHub repository willdady/platypus (124 stars, last pushed yesterday), licensed MIT. It adds 51 tokens to every session and 3,225 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.
Other skills, from other repositories
compiler-commit
Use when you want to verify compiler changes and commit with the correct convention. Runs tests, lint, and format, then commits with the [compiler] or [rust-compiler] prefix.
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.
validate-release-green
Run or inspect the local Release-Green observer for an exact base or combined PR candidate, separating hard failures, advisory drift and incomplete evidence. Use for maintainer preflight; full CI acceptance remains a separate requirement.
release
Cut and maintain Observal release branches, prepare alpha, beta, RC, stable, and patch releases, backport merged main PRs, inspect release status, verify published artifacts, and recover failed release operations. Use for Observal maintainer release tasks and release-process changes, not for installing or upgrading an…
release-safety
Release safety rules. INVOKE WHEN: yarn release, npm publish, release canary, release packages, publishing, skip checks, skip tests. NEVER skip checks or tests without explicit permission.
ship
Pre-release gate — run the full gate, responsive + render checks, then produce the release checklist (README badge/current/changelog). Use before tagging a release.